The Wiert Corner – irregular stream of stuff

If you run LLMs or Generative AI locally instead of in a sandbox, then watch for downloaded AGENTS.md files – they could be malicious.

From a few weeks back, this warning: [Wayback/Archive] Markdown Is the New Executable: Attackers Are Dropping Agent Instructions Into Your Downloads Folder From the Web · Forever Security

Executive Summary

This did not start in a lab. Forever caught live malware on a real customer’s machine, attempting a new kind of attack the industry had not documented – and stopped it cold, before any code ran.

• Forever Security found a malicious AGENTS.md file in the ~/Downloads folder of a real customer machine – plain text, disguised as ordinary engineering notes.
• This is not ordinary malware. An AGENTS.md is a file a coding agent is built to trust and obey, and ~/Downloads is the one folder a website can drop a file into with no click and no permission. Together, that lets the web plant orders your own agent carries out. Markdown is the new executable.
• The planted file makes the agent rewrite its own configuration. From there it can install malware (remote code execution) or hand over its own login token (account takeover).
• We reproduced the whole attack on both OpenAI Codex and Claude Code – on Codex with the real malicious package, run safely inside an isolated VM. This is not one product’s bug; it is a property of how agents work.
• There is nothing here for OpenAI or Anthropic to patch. An agent that follows the AGENTS.md in its folder is doing exactly what it was built to do, the same way a browser that renders a phishing page is working as designed. The problem is the circumstances: a folder the web can write to, trusted as if the user filled it. So the vector stays open. It is one early example of a bigger pattern: defenses built around a human break when an agent takes the human’s place.
• In our telemetry, about half of customers run a coding agent inside their Downloads folder, and roughly a quarter of agent sessions open a real browser.

The best remedy of course not to run Generative AI at all (;

Bumped into it earlier and reminded of it again by [Wayback/Archive] Tedi Heriyanto: “Markdown Is the New Executable…” – Infosec Exchange. Thanks!

--jeroen