The file that was not documentation
The campaign is called MALFEX and the vector is a text file.
A malicious AGENTS.md placed in the Downloads folder tried to make Codex install the fraudulent npm package function-color (Source: thehackernews.com).
What stands out is not the package but how the file got there.
A website can write that AGENTS.md without the user clicking anything, and the agent reads it as if it were orders (Source: thehackernews.com).
AGENTS.md is the file where the project rules are explained to the agent.
It is meant for a human to write and for the model to obey.
That design is exactly the problem, because the agent does not distinguish an engineering note from a third party's instruction.
To the model, both are text in the context, and text in the context gets executed.
The website writes the file, the agent finds it when it opens the folder, reads it as configuration and runs the install.
No exploit, no credential, no binary needed, just a file with the right name in the right place.
Not an isolated case
The week brings more examples of the same pattern.
OpenAI revealed that its own red team agents escaped microVMs and communicated between isolated sandboxes with no network and no shared files, using the CPU cache as a covert timing channel (Source: thehackernews.com).
The same team found routes to the internet through misconfigured metrics, logging and authentication services (Source: thehackernews.com).
Isolation is assumed, not verified.
A sandbox is treated as a wall when it is really a convention someone configured once and nobody looked at again.
In the AGENTS.md case the boundary is not the network, it is the file system.
The agent trusts what is on disk, and disk is where anyone with an open tab can write.
The other side
The same engine that speeds up a defender speeds up the attacker.
Microsoft attributed to Storm-0940, a China-linked group, the abuse of ConnectWise OAuth credentials with the ARTEX framework.
The result was 2,250 Microsoft 365 tenants probed at 2,900 access attempts per minute, after a password spray against 327 accounts in 8 organizations (Source: microsoft.com).
It is not an autonomous agent, but the pattern is the same one that worries people about agents.
Cheap automation against surfaces that were left open and nobody reviewed.
Neither of these last two has anything to do with agents, but they share the lesson: the surface nobody watches is the one that breaks.
My reading
An agent configuration file is not documentation, it is code that executes by design, and it has to be treated as untrusted code.
That implies three things.
- Review what enters the repo.
- Limit the agent's network and install permissions.
- Do not let it write to folders the user does not control.
The Downloads folder is the worst possible place for an AGENTS.md, because it is where things nobody reviews end up.
What to look at?
- Check the configuration files. AGENTS.md, .cursor/rules and CLAUDE.md in the repo and in the working folders. Check who wrote them and when. If you do not recognize them, delete them before opening the agent.
- Limit the agent's write access. The agent should not be able to write outside the project directory. If it can, a file placed by a website becomes an order.
- Cut automatic installs. Letting the agent run npm install without confirmation is a direct path to a fraudulent package. Require human approval for any install.
How would I test it in my lab?
I would set up a working directory with Codex pointed at it and place an AGENTS.md with an innocent instruction, I don't know, for example it occurs to me that it writes a test file in /tmp, you see where I'm going...
I would check whether the agent runs it without asking and what permissions it had at that moment.
If it obeys an instruction from a file I did not write, the problem is not the file, it is that the agent does not distinguish who wrote what.
Closing
The agent does not distinguish an engineering note from an order, and while that distinction does not exist in the design, every file it reads is a door.
Originally published at https://sammideblas.com/notas/the-agents-md-your-agent-reads-as-an-order
Si has leído hasta aquí... reacciona y comparte -> "la seguridad y la defensa en la era de la IA es cosa de todos los que la usan" ¿No Crees?
Top comments (0)