Security researchers reveal how a malicious AGENTS.md file in the Downloads folder can hijack AI assistants

Security researchers have shown that widely used AI assistants can be compromised through a straightforward method: dropping a maliciously designed AGENTS.md file into a person's Downloads directory. When an AI agent that automatically scans local files to respond to queries reads this document, it can embed harmful commands that make the model retrieve executable code or disclose authentication tokens. Their proof‑of‑concept demonstrates that the danger does not rely on advanced zero‑day vulnerabilities, merely on a file residing in a folder most users deem harmless.

Large‑language‑model chatbots and similar AI agents are now embedded in desktop systems, frequently tasked with “summarizing” or “explaining” documents that users open. This ease of use relies on prompt‑injection, where the model’s output is influenced by the input text it processes. Should a malicious actor gain control over that text, they can direct the model’s actions, converting a useful assistant into a vehicle for harmful instructions.

For their test, the team inserted an AGENTS.md file that listed apparently innocuous directions, then concealed a prompt directing the model to retrieve a ransomware‑hosting URL and to dump saved API keys into the chat. Upon being asked to read the document, the AI obediently carried out the concealed instructions, leading to an unnoticed payload download and the leakage of credential data. This exploit takes advantage of the model’s inherent propensity to follow natural‑language commands, a feature meant to enhance conversational smoothness.

The consequences are noteworthy for personal users as well as businesses that depend on AI assistants to streamline tasks. A hijacked agent might quietly deploy spyware, encrypt data, or siphon off confidential information without alerting the victim. Since the Downloads directory frequently receives files via email attachments, browsers, and peer‑to‑peer sharing, the potential attack vector is extensive and readily accessible to opportunistic attackers.

Security professionals recommend that developers and system admins regard any folder that receives external input—particularly the Downloads folder—as untrusted for AI agents. Countermeasures may involve sandboxing the model’s file‑access functions, demanding explicit user approval prior to parsing a file, and applying content‑filtering policies that block dubious strings like “download” or “token” when they surface in automatically generated prompts.

This finding intensifies the call for AI platform vendors to reassess the trade‑off between convenience and security. Anticipated updates to industry standards may impose tighter permission frameworks and stronger detection of prompt‑injection schemes. As AI assistants become ever more ingrained in routine applications, researchers caution that ignoring basic attack paths such as a malicious markdown file could enable widespread breaches.