AI Coding Agents Can Be Hijacked Through Downloaded Instruction Files

The security boundary for an AI coding agent can be thinner than its interface suggests: a Markdown file that looks like project guidance may persuade the agent to change settings, run software or expose credentials. Forever Security reported blocking one attempted attack on a customer’s machine and reproduced related techniques against OpenAI Codex and Anthropic Claude Code.

The incident centered on an AGENTS.md file found in the customer’s Downloads folder. It told Codex to install a malicious npm package called function-color. The installation was stopped before the malware ran. Researchers couldn’t establish how the file arrived, but demonstrated that a malicious website could prompt a similar download without a separate approval request.

These files aren’t executable. The attack depends on agents treating their contents as instructions and acting with the permissions already available to them. Codex reads AGENTS.md; Claude Code supports CLAUDE.md. The agent must work in the directory containing the file, and Codex must also consider that directory trusted.

Instructions can reach beyond a project

Using the recovered file, Forever Security found that Codex could be directed to alter its machine-wide MCP server configuration and start another session with approval and sandbox restrictions bypassed. Codex followed the instructions in more than 90% of tests, most of which used a harmless stand-in for the malware.

The configuration change could outlast the original directory: a malicious server added at the machine level could load in later sessions after a developer had moved elsewhere. That persistence turns a file encountered during one task into a potential risk for subsequent work.

Claude Code presented a different path. In about half of the tests, a malicious CLAUDE.md file redirected API traffic to a server controlled by the researchers. That could expose authentication tokens and let the server return commands for the agent to run. Researchers also replayed a captured OAuth token against the legitimate API, showing a route to account compromise.

The results are an early warning, not proof of widespread exploitation. Sakshi Grover, IDC’s senior research manager for cybersecurity products and services in Asia/Pacific, said the reported success rates differed between agents and hadn’t been independently validated.

The design problem is trust and permission

AI coding agents need to follow project guidance, yet they may also have access to credentials, system settings and the ability to execute commands. Akshat Tyagi, associate practice leader at HFS Research, described the underlying weakness as a failure to distinguish instruction from authorization: “The deeper issue is that these tools treat following an instruction and granting a privilege as the same act.”

Tyagi said vendors should keep project instructions from changing an agent’s security settings without separate human approval. Grover called for checking where instruction files came from and asking users before loading files from untrusted sources.

Downloads is only one place an agent might encounter hostile content. Cloned repositories, shared drives and package contents could carry similar instructions. “The more consequential risk is not Downloads specifically but the broader pattern of agents ingesting untrusted content and holding live credentials,” Grover said.

Controls for agent workflows

Confidence in enterprise defenses remains uneven. An Omdia Cybersecurity Decision-Maker survey found that 40% of respondents were only somewhat confident or not confident that their organizations could secure AI agents, according to Jonathan Ong, Omdia’s senior analyst for managed security services.

Ong recommended human oversight for suspicious behavior and limits on settings that let agents bypass safeguards. He specifically pointed to disabling flags such as “–dangerously-bypass-approvals-and-sandbox” to restrict high-risk actions.

Amit Kumar Jena, development manager for AI at Kanerika, advised treating AGENTS.md, CLAUDE.md and related configuration files like source code, with named owners reviewing changes. He also recommended keeping sandboxes enabled, limiting network access, and routing package installs through internal registries or scanning proxies.

For developers whose machines hold production credentials, Jena suggested isolated development environments and enterprise-controlled gateways that use shorter-lived tokens. His practical dividing line is clear: “An instruction file can change what the agent tries. It must never change what the agent is allowed to do.”