Malicious instruction files planted in a computer’s Downloads folder can trick AI coding agents into executing harmful code or exposing authentication tokens, Forever Security said after blocking an attempted attack on a customer’s machine and demonstrating similar techniques against OpenAI’s Codex and Anthropic’s Claude Code.
In its research report, the firm said it discovered a malicious AGENTS.md file in a customer’s Downloads folder that instructed Codex to install a malicious npm package called function-color. The installation was blocked before the malware could execute.
The researchers could not determine how the original file reached the computer, but demonstrated that a malicious website could trigger a similar download without a separate approval prompt.
The attack exploits the way AI coding assistants process project-specific instructions. Codex uses AGENTS.md, while Claude Code supports CLAUDE.md. Both can interpret instructions contained in these Markdown files when operating in directories where the files are present.
The attack requires the agent to operate in the affected directory and process the malicious file. For Codex, the directory must also be trusted, according to Forever Security.
In tests using the file recovered from the customer’s machine, Forever Security found that Codex could be manipulated into modifying its machine-wide MCP server configuration and launching another session with approval and sandbox restrictions bypassed.
Codex followed the malicious instructions in more than 90% of tests, most of which used a harmless substitute for the malware. Because the malicious server was registered in Codex’s machine-wide configuration, it could also be loaded in subsequent sessions, even after the developer moved to another directory.
A separate demonstration against Claude Code showed that a malicious CLAUDE.md file could redirect the agent’s API traffic to a researcher-controlled server, exposing authentication tokens and allowing the server to supply commands for execution. The configuration manipulation succeeded in approximately half of the tests.
The researchers also successfully replayed a captured OAuth token against the legitimate API, demonstrating the potential for account compromise.
The Markdown files contain no executable code. Instead, the attack relies on an AI agent interpreting their contents as legitimate instructions and carrying them out with its existing permissions.
Commenting on Forever Security’s findings, Sakshi Grover, senior research manager for cybersecurity products and services for Asia/Pacific at IDC, said the research was a credible early warning rather than evidence of widespread exploitation. She noted that the reported success rates varied between agents and had not been independently validated.
An architectural weakness
The findings expose a broader design problem in AI coding agents, which are expected to follow project instructions but may also have access to sensitive configurations and execution privileges, according to Akshat Tyagi, associate practice leader at HFS Research.
“The deeper issue is that these tools treat following an instruction and granting a privilege as the same act,” Tyagi said.
He argued that vendors must separate the two, ensuring that instructions from project files cannot authorize changes to an agent’s security settings without independent human approval.
Grover said vendors should verify the origin of instruction files and require explicit approval before loading those from untrusted sources, rather than automatically treating them as authoritative.
Attackers could adapt the technique to other locations accessible to coding agents, including cloned repositories, shared drives, and package contents.
“The more consequential risk is not Downloads specifically but the broader pattern of agents ingesting untrusted content and holding live credentials,” Grover said.
Securing AI coding agents
The findings come amid uncertainty over enterprises’ ability to secure autonomous agents. An Omdia Cybersecurity Decision-Maker survey found that 40% of respondents were only somewhat confident or not confident in their organizations’ ability to secure AI agents, according to Jonathan Ong, senior analyst for managed security services at Omdia.
Ong recommended human oversight to identify suspicious agent behavior and restrictions on settings that allow agents to bypass security controls.
“Disabling flags such as ‘–dangerously-bypass-approvals-and-sandbox’ would limit the agent’s authorization to run high-risk actions,” Ong said.
Amit Kumar Jena, development manager for AI at Kanerika, recommended treating agent instruction files like source code, with designated owners reviewing changes to AGENTS.md, CLAUDE.md and related configuration directories.
He also advised keeping sandboxes enabled, restricting network access, and routing software installations through internal package registries or scanning proxies. For developers with production credentials on their machines, he recommended isolated development environments and enterprise-controlled gateways with shorter-lived authentication tokens. “An instruction file can change what the agent tries,” Jena said. “It must never change what the agent is allowed to do.”
The article originally appeared on CSO.
