Science & Tech · Cybersecurity · 3 hrs ago
Researchers uncover two ways AI agents can be turned against users
Researchers described two separate risks involving AI agents.
Forever Security found a malicious AGENTS.md file in a customer’s Downloads folder that led a coding agent to try to install a rogue package.
These files give coding agents instructions, and the agent may act on harmful directions when it loads them from its working folder.
Researchers reproduced the attack with OpenAI Codex and demonstrated a related method against Claude Code that could steal OAuth tokens and hijack an account.
Separately, Symantec researchers uncovered an attack agent built to hijack exposed AI models and direct them to steal data, gather credentials, run code or mine cryptocurrency.
The tool was designed to run for up to 100,000 steps without human approval, but researchers found no evidence it was used in real-world attacks.
The findings show how agents’ access to files, tools and computing resources can create risks, though the sources describe no specific next steps.
Researchers reported two ways AI agents can be manipulated to carry out harmful actions.
Forever Security found a malicious AGENTS.md file in a customer’s Downloads folder that prompted a coding agent to try to install a rogue npm package.
The researchers reproduced attacks involving OpenAI Codex and Claude Code, including a technique to steal OAuth tokens and hijack an account.
Separately, Symantec researchers uncovered an attack agent designed to hijack exposed AI models and run attacks for up to 100,000 steps without human approval.
Symantec said it had no evidence that the agent was used in real-world attacks.
- Who
- Researchers at Forever Security and Symantec reported the findings.
- What
- One attack used malicious instructions to manipulate coding agents; another used an autonomous agent to hijack exposed AI models for attacks.
- When
- Symantec researchers uncovered the agent’s instructions over the summer. The articles were published on October 24 and 25, 2026.
- Where
- The malicious instruction file was found in a customer’s Downloads folder. The other agent was designed to scan the internet for exposed AI model endpoints.
- Why
- The instruction-file attack sought to make coding agents run commands or steal credentials. The autonomous agent was designed to exploit systems and carry out illicit actions.
This story does not have two clearly opposing sides.
Symantec’s Threat Hunter Team captured the autonomous agent’s instructions in an AI honeypot.
The Register published its report on the autonomous attack agent.
BleepingComputer published its report on malicious AGENTS.md instructions targeting coding agents.
- Malicious file
- AGENTS.md in a customer’s Downloads folder
- Rogue package
- function-color
- Test result
- Codex attack reproduced with a harmless payload and a 90% success rate
- Autonomous agent
- Designed to run for up to 100,000 steps without human approval
- Offensive tools
- The captured instructions included 74 offensive tool definitions
- Symantec finding
- Researchers said they had no evidence of real-world use of the agent
3 sources
What people are saying
There is nothing here for OpenAI or Anthropic to patch. An agent that follows the AGENTS.md in its folder is doing exactly what it was built to do
Nothing in the individual techniques is new. What stands out is that someone wired them into a single agent that hands the planning to a borrowed model and runs for up to 100,000 steps without a human.
The owner of the exposed endpoint pays for the inference. Any server the agent went on to break into would lose data and be put to work mining. We have no evidence yet that it got that far.