Malicious files can trick AI coding agents into compromising systems

The discovery of instruction exploits

Forever Security identified a security flaw where AI coding agents can be manipulated into performing harmful actions. The firm discovered a malicious file named AGENTS.md hidden in a customer's Downloads folder. This file was designed to trick the OpenAI Codex agent into installing a malicious software package.

The researchers were able to block the attack before the malware executed on the customer's machine. However, they demonstrated that similar techniques could work against other popular tools, including Anthropic’s Claude Code. They found that these agents are designed to automatically interpret instructions found in specific Markdown files when they operate in a directory.

The attack is particularly effective because it does not require the file to contain any actual executable code. Instead, it relies on the AI agent interpreting the text within the file as a legitimate command. Because the agents are built to be helpful and follow project-specific directions, they carry out the instructions using their existing permissions.

How the manipulation works

The exploit targets the way coding assistants process project-specific instructions like AGENTS.md for Codex or CLAUDE.md for Claude Code. For the attack to succeed, the agent must be operating in the directory where the malicious file is located. In the case of Codex, the directory must also be marked as a trusted location by the user.

In testing with Codex, researchers found the agent could be tricked into modifying its machine-wide MCP server configuration. This allowed the agent to launch a new session that bypassed standard sandbox restrictions and approval prompts. Because the malicious server was registered in a machine-wide configuration, it remained active even if the developer moved to a different directory.

A separate test on Claude Code showed that a malicious CLAUDE.md file could redirect the agent's API traffic to a server controlled by a researcher. This action exposed authentication tokens and allowed the external server to supply commands for the agent to execute. The configuration manipulation succeeded in approximately half of the tests conducted by the security firm.

Architectural flaws in AI agents

Experts suggest the issue stems from a broader design problem where AI tools treat following an instruction and granting a privilege as the same act. Akshat Tyagi of HFS Research noted that vendors must separate these two actions. He argued that instructions from project files should not be able to authorize changes to an agent's security settings without a human providing independent approval.

The research highlights a risk where agents ingest untrusted content while holding live credentials. Sakshi Grover of IDC noted that while this is a credible early warning, it is not yet evidence of widespread exploitation. She pointed out that the success rates varied between different agents and have not been independently validated by outside parties yet.

Attackers have several ways to deliver these malicious files beyond a simple Downloads folder. They could place them in cloned repositories, shared drives, or even within the contents of software packages. The risk is not limited to one specific folder but rather the broader pattern of agents processing untrusted content in various locations.

Securing the development workflow

Organizations are currently struggling to figure out how to secure these autonomous agents effectively. A survey by Omdia found that 40% of cybersecurity decision-makers are only somewhat confident or not confident in their ability to secure AI agents. Experts recommend implementing human oversight to identify suspicious behavior and placing strict limits on settings that allow agents to bypass security controls.

One specific recommendation is to disable flags that allow agents to bypass approvals and sandboxes. Amit Kumar Jena of Kanerika suggested treating agent instruction files like source code. This means having designated owners review any changes made to files like AGENTS.md or CLAUDE.md before they are used by the AI agent.

Developers can also use isolated environments and enterprise-controlled gateways with short-lived authentication tokens. These measures help ensure that even if an instruction file is compromised, the agent's reach is limited. Jena noted that while an instruction file can change what an agent tries, it must never change what the agent is allowed to do.

Next steps for developers

To protect against these types of attacks, developers should be wary of any AI agent that automatically trusts local files. It is important to verify the origin of any instruction files before allowing an agent to process them. Users should look for ways to require explicit approval before an agent loads instructions from an untrusted source.

Security teams should also consider routing all software installations through internal registries or scanning proxies. This prevents agents from downloading and installing unauthorized packages from the public internet. Keeping sandboxes enabled remains a critical defense for limiting the potential damage of a successful trick.

As these tools become more common in professional workflows, the focus will likely shift toward better permission models. Vendors will need to develop systems that distinguish between a project's goals and the permissions required to achieve them. For now, manual review and environment isolation are the most reliable ways to stay safe.