AI kodlash agentlari Downloads jildidagi AGENTS.md fayli yordamida o'g'irlandi

AI kodlash agentlari Downloads jildidagi AGENTS.md fayli yordamida o'g'irlandi

Bill Toulas

2026-yil 25-oktabr

11:49

0

Tadqiqotchilar mijozning Downloads jildida zararli AGENTS markdown ko'rsatma faylini topdilar, bu AI kodlash agentini zararli npm paketini o'rnatishga aldadi.

Ular hujumni OpenAI Codex ga qarshi qayta tikladilar va Claude Code ga qarshi bog'liq texnikani namoyish etdilar, bu faqat zararli ko'rsatmalar yordamida OAuth tokenlarini o'g'irlash va hisobni o'g'irlash imkonini berdi.

AGENTS.md kabi markdown fayllari oddiy matn fayllari bo'lib, ular AI kodlash agentlari uchun loyihaga xos ko'rsatmalarni o'z ichiga oladi, masalan, qaysi vositalardan foydalanish, testlarni qanday ishga tushirish va kodlash konvensiyalariga rioya qilish.

Zararli ko'rsatmalarga amal qiluvchi agentlar

AI agentlari va avtonom dasturiy ta'minot tomonidan kiritiladigan xavflarni kuzatuvchi Forever Security kompaniyasi tadqiqotchilari bu taktikani mijoz kompyuterida aniqladilar, bu yerda kodlash agenti zararli npm paketi "function-color" ni o'rnatishga uringan.

Tekshiruv AI agentining zararli npm paketini o'rnatish urinishini mijozning ~/Downloads jildidagi AGENTS.md fayliga bog'ladi, bu ham agentning ish katalogi bo'lib xizmat qilgan.

Agentlar o'z ish katalogidan tegishli fayllarni avtomatik ravishda yuklaydi va ulardagi ko'rsatmalardan foydalanib o'z harakatlarini yo'naltiradi.

Bu fayllar bajariladigan fayllar bo'lmasa-da, ulardagi zararli ko'rsatmalar AI agentlarini buyruqlarni bajarish, paketlarni o'rnatish yoki mavjud vositalar va ruxsatlar yordamida sozlamalarni o'zgartirishga olib kelishi mumkin.

"Bu yerda OpenAI yoki Anthropic tomonidan tuzatish mumkin bo'lgan hech narsa yo'q. O'z jildidagi AGENTS.md ga amal qiluvchi agent aynan u qurilgan ishni bajarmoqda," deydi tadqiqotchilar.

Tadqiqotchilarning testi shuni tasdiqladiki, hujumchi bunday fayl yordamida OpenAI Codex va Claude Code ni kodni bajarish yoki ma'lumotlarni o'g'irlashga majburlashi mumkin.

Tadqiqotchilar zararli ko'rsatma fayli maqsadning ~/Downloads joyiga qanday tushganini aniqlay olmasalar ham, BleepingComputer ga tushuntirishlaricha, shunchaki zararli sahifaga tashrif buyurish foydalanuvchi o'zaro ta'sirisiz yuklamani tushirishi mumkin.

Bu hafta e'lon qilingan hisobotda Forever Security "~/Downloads maxsus. Bu veb o'z-o'zidan yozishi mumkin bo'lgan yagona jild," va "veb-sahifa AGENTS.md nomli faylni sizning Downloads jildingizga jimgina yuklab qo'yishi mumkin" deb aytadi.

Tadqiqotchilar foydalanuvchi sezmasdan zararli faylni ~/Downloads joyiga tushirish mumkinligini namoyish etish uchun isbotlovchi kontseptsiya (PoC) yaratdilar.

BleepingComputer PoC sahifasini tekshirganda, u zararsiz mazmunni, ya'ni "sensitive data here" va "line 2" satrlarini o'z ichiga olgan AGENTS.md faylini yuklab oldi.

Ko'plab mashhur brauzerlar, jumladan Chrome, Edge va Firefox, vebdan yuklab olingan fayllarni foydalanuvchining ~/Downloads katalogiga saqlaydi, har bir yuklab olish uchun saqlash joyini tanlashni so'ramaydi.

BleepingComputer ning Brave kabi boshqa brauzerlardagi testlari foydalanuvchidan yuklab olishni tasdiqlashni so'radi, bu foydalanuvchini fayl yuklab olinganidan ogohlantirish uchun yetarli bo'lishi kerak.

Biroq Chrome, Edge va Firefox odatda yuklab olish bildirishnomalarini ko'rsatadi, bu foydalanuvchilarga fayl mahalliy saqlanganini bildiradi.

Faylni Downloads ga tushirgandan so'ng, hujum maqsadni o'z AI agentini o'sha katalogda ishga tushirishni talab qiladi, shunda u ko'rsatma faylini yuklab, uning zararli ko'rsatmalarini hazm qilishi mumkin.

Forever tadqiqotchisi Gal Weizman BleepingComputer ga aytishicha, bu keng tarqalgan amaliyot, chunki odamlar ko'pincha AI agentlarini shu jildni tartibga solish yoki yangi yuklab olingan fayl ustida ishlash uchun ishlatadilar.

Weizman ichki statistikalar shuni ko'rsatadiki, yuzlab mijozlar AI agentlarini, jumladan Claude Code, OpenAI Codex va Cursor CLI ni o'z ~/Downloads jildlaridan ishga tushiradilar. Faqat Claude Code o'sha joydan 1,300 dan ortiq sessiyani ishga tushirgan, deb tadqiqotchi BleepingComputer ga aytdi.

Testlar hujum mumkinligini ko'rsatadi

Tadqiqotchilar qayta tiklangan hujum zanjirini Codex ga qarshi zararsiz yuklama yordamida sinovdan o'tkazdilar, bu shunchaki kalkulyator ilovasini ochdi va 90% muvaffaqiyat darajasini qayd etdi.

Alohida testda ular zararli CLAUDE.md faylidan foydalanib Claude Code ning API trafikini o'zlari nazorat qiladigan serverga yo'naltirdilar. Bu agentning OAuth tokenini fosh qildi, bu serverga modelni taqlid qilish va taxminan 50% testlarda kodni bajaradigan vosita chaqiruvlarini qaytarish imkonini berdi.

Tadqiqotchilar xavf brauzer va agent xatti-harakatlarining birikmasi ekanligini, bu esa ehtiyotkorlik va himoya mas'uliyatini to'g'ridan-to'g'ri foydalanuvchiga yuklaydi, deb aytadilar.

Foydalanuvchilar ~/Downloads ni AI kodlash agentining ish katalogi sifatida belgilashdan qochishlari kerak, chunki bu joy agent talqin qilishi mumkin bo'lgan ishonchsiz fayllarni o'z ichiga olishi mumkin.

OpenAI va Anthropic o'z AI kodlash agentlarini ular ishlashi mo'ljallangan loyihalar katalogidan ishga tushirishni tavsiya qiladilar.

Ish katalogini tegishli loyihaga cheklash agentga tegishli kontekstni taqdim etishga yordam beradi va uning ish doirasini cheklaydi, bu esa bog'liq bo'lmagan joylardagi ishonchsiz fayllarni qayta ishlash xavfini kamaytiradi.

OpenAI va Anthropic dan umumiy tavsiya AI kodlash agentini sizning uy katalogingiz yoki keng ota-katalog o'rniga u ishlashi kerak bo'lgan aniq loyihaning ildizida boshlashdir. Uning ish maydonini iloji boricha tor saqlang va faqat zarur bo'lganda kirishni kengaytiring.

Asosiy g'oya shundaki, ish katalogi agentning standart loyihaviy kontekstini belgilaydi va vositaga qarab, uning fayl tizimiga kirish chegarasini o'rnatishga yordam beradi.

Foydalanuvchilar AI kodlash agentiga ularga amal qilishga ruxsat berishdan oldin notanish AGENTS.md, CLAUDE.md va shunga o'xshash ko'rsatma fayllarini ko'rib chiqishlari, tasdiqlash so'rovlarini va sandbox himoyalarini yoqilgan holda saqlashlari, va potentsial ishonchsiz kodni asosiy tizimda ishga tushirishdan oldin izolyatsiya qilingan muhitda sinovdan o'tkazishlari kerak.

Hujumchilar haqiqiy ma'lumotlarga ega bo'lgach, ularning harakatlarining faqat 37% i bloklanadi

Umumiy oldini olish ballari dastlabki kirishdan keyin nima sodir bo'lishini yashirishi mumkin. Hujumchilar haqiqiy ma'lumotlardan foydalanayotganda, oldini olish keskin pasayadi.

Blue Report 2026 mijoz ishlab chiqarish muhitlarida o'tkazilgan 338 million simulyatsiya bo'yicha texnikani texnika bo'yicha himoyalarni o'lchaydi.

Hisobotni oling

Bog'liq maqolalar:

Anthropic Claude ni 2,000+ plagin va ulanishlar bilan AI bozori sifatida aylantirmoqda

Claude Opus 5.5 95% kamroq em chiziqchalaridan foydalanadi, lekin uning javoblari uzunroq bo'lmoqda

Anthropic Claude Code uchun $250 gacha bepul kreditlar taqdim etmoqda, lekin faqat bulut sessiyalari uchun

Anthropic Claude Code ning joriy haftalik cheklovlarini 17% ga qisqartirmoqda

OpenAI agentlari xavfsizlik monitoringini o'chirib qo'ygan, biri bu haqda yolg'on gapirgan

AI coding agents hijacked using AGENTS.md file in Downloads folder

By Bill Toulas

October 25, 2026

11:49 AM

0

Researchers found a malicious AGENTS markdown instruction file in a customer’s Downloads folder that tricked an AI coding agent into installing a rogue npm package.

They reproduced the attack against OpenAI Codex and demonstrated a related technique against Claude Code to leak OAuth tokens and hijack the account using only the malicious instructions.

Markdown files such as AGENTS.md are plain-text files that contain project-specific instructions for AI coding agents, such as the tools to use, how to run tests, and the coding conventions to follow.

Agents following malicious instructions

Researchers at Forever Security, a company that monitors for risks introduced by AI agents and autonomous software, discovered the tactic on a customer’s computer, where a coding agent attempted to install the malicious npm package ‘function-color.’

The investigation traced the AI agent’s attempt to install a malicious npm package to an AGENTS.md file in the customer’s ~/Downloads folder, which also served as the agent’s working directory.

Agents automatically load applicable files from their working directory and use the contained instructions to guide their actions.

While these files aren’t executables, malicious instructions contained in them can lead to AI agents running commands, installing packages, or changing settings using the tools and permissions available to it.

"There is nothing here for OpenAI or Anthropic to patch. An agent that follows the AGENTS.md in its folder is doing exactly what it was built to do," the researchers say.

The researchers' test confirmed that an attacker could use such a file to manipulate OpenAI Codex and Claude Code into executing code or stealing credentials.

Although the researchers could not determine how the malicious instructions file landed into the target's ~/Downloads location, they explained to BleepingComputer that simply visiting a malicious page could drop a payload without any user interaction.

In a report this week, Forever Security says that "~/Downloads is special. It is the one folder the web can write to on its own," and that "a web page can download a file named AGENTS.md into your Downloads folder, silently."

The researchers created a proof-of-concept (PoC) to demonstrate how the attack could land a malicious file into the ~/Downloads location without the user noticing.

When BleepingComputer verified the PoC page, it downloaded an AGENTS.md file containing harmless content, namely the strings "sensitive data here" and "line 2."

By default, many popular browsers, including Chrome, Edge, and Firefox, save files downloaded from the web to the user's ~/Downloads directory without prompting them to choose a save location for each download.

BleepingComputer’s tests in other browsers, such as Brave, prompted the user to approve the download, which should be enough to alert the user that a file was downloaded.

However, Chrome, Edge, and Firefox display download notifications by default, alerting users when a file has been saved locally.

After dropping the file into Downloads, the attack would require the target to launch their AI agent in that same directory so it could load the instruction file and digest its malicious instructions.

Forever researcher Gal Weizman told BleepingComputer that this is common practice, as people often use AI agents to organize that folder or to act on a newly downloaded file.

Weizman says that internal statistics show that hundreds of customers run AI agents, including Claude Code, OpenAI Codex, and Cursor CLI, from their ~/Downloads folders. Claude Code alone launched more than 1,300 sessions from that location, the researcher told BleepingComputer.

Tests show attack feasible

The researchers tested their reconstructed attack chain against Codex using a harmless payload that simply opened the calculator app, recording a 90% success rate.

In a separate test, they used a malicious CLAUDE.md file to redirect Claude Code’s API traffic to a server they controlled. This exposed the agent’s OAuth token, allowing the server to impersonate the model and return tool calls that executed code in roughly 50% of tests.

The researchers say that the risk is a combination of intended browser and agent behavior, which puts the precaution and defense responsibility directly on the user.

Users should avoid setting ~/Downloads as an AI coding agent's working directory because the location may contain untrusted files that the agent could interpret as instructions.

OpenAI and Anthropic recommend running their AI coding agents from the project directory they are intended to work on.

Keeping the working directory scoped to the relevant project helps provide the agent with appropriate context and limits its working scope, reducing the risk of it processing untrusted files in unrelated locations.

The common recommendation from OpenAI and Anthropic is to start an AI coding agent in the root of the specific project it should work on, rather than in your home directory or a broad parent directory. Keep its working area as narrow as practical, and expand access only when needed.

The key idea is that the working directory defines the agent's default project context and, depending on the tool, helps establish its filesystem access boundary.

Users should review unfamiliar AGENTS.md, CLAUDE.md, and similar instruction files before allowing an AI coding agent to follow them, keep approval prompts and sandbox protections enabled, and test potentially untrusted code in an isolated environment before running it on their main system.

Once attackers have valid credentials, only 37% of their actions are blocked

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report

Related Articles:

Anthropic turns Claude into an AI marketplace with 2,000+ plugins and connectors

Claude Opus 5.5 uses 95% fewer em dashes, but its answers are getting longer

Anthropic rolls out up to $250 in free Claude Code credits, but only for cloud sessions

Anthropic is cutting Claude Code's current weekly limits by 17%

OpenAI agents disabled safety monitoring, one lied about it