Why an AGENTS.md File Can Become a Security Trap for AI Agents

Introduction

Traditional desktop security often relies on a simple assumption: if a user does not run an executable or approve a suspicious prompt, the attack will stop. Coding agents such as Claude Code, Codex, and Cursor complicate that model. They can read local files, invoke shells, install tools, and edit configuration. As a result, a plain Markdown file may become an entry point—not because Markdown is executable, but because an agent may treat its natural-language instructions as part of the project’s trusted context.

According to the report summarized by QbitAI, Forever Security demonstrated an attack path involving files such as AGENTS.md and CLAUDE.md. An attacker can place carefully written instructions in a downloaded project, a shared repository, or another directory. When a user starts an agent there, the agent may interpret the document as legitimate development guidance and carry out environment-setup steps that benefit the attacker.

Key points

• The risk comes from the agent’s action boundary. A Markdown file has no conventional execution privilege, but an agent that reads it may call a shell, edit settings, or install packages.
• Dangerous actions can be disguised as routine setup. Instead of asking for an obviously malicious command, an attacker can describe changes as toolchain initialization, validation, or team workflow requirements.
• Global settings can extend the impact. A modification to a user-level configuration file may continue to affect future sessions and unrelated projects.
• Network routing deserves scrutiny. Changes to project settings or environment variables could direct model requests through an unfamiliar gateway, creating a risk to API keys, OAuth sessions, or other credentials.

Practical defenses

Users should avoid launching a highly privileged agent directly from Downloads, Desktop, or any other directory with uncertain provenance. Before opening a new repository or downloaded package with an agent, inspect AGENTS.md, CLAUDE.md, hidden configuration files, and recent changes. Global configuration files and MCP server definitions should also be reviewed for unfamiliar commands, temporary-directory scripts, or unexpected proxy endpoints.

If suspicious changes are found, stop using the environment, isolate it, and rotate exposed API keys or session credentials. More broadly, treat an agent as an automation account that can operate a computer, not as a passive chatbot. Sandboxes, dedicated workspaces, least-privilege accounts, and manual approval for high-impact actions can sharply reduce the blast radius. Sensitive files such as .env files, SSH keys, cloud credentials, and private configuration directories should not be exposed unnecessarily.

Why it matters

The existence of this attack path does not mean every AGENTS.md file is malicious, nor does one clean check prove that a system is safe. The broader lesson is that security models built around a human making the final click are becoming less sufficient. The more capable an agent is at understanding context and completing tasks, the more important source verification, permission isolation, and auditable execution become. AI security is no longer only about whether a model gives a correct answer; it is also about what the model reads, what it trusts, and what it is allowed to do.

Source: QbitAI