Summary
- A malicious AGENTS.md file prompted a customer agent to attempt installation of a rogue npm package.
- Controlled research found high success rates against Codex and a separate Claude Code technique.
- Filigran and CyberSmart emphasise restricted access, instruction review and sandbox or approval controls.
AI coding agents can be manipulated into installing software or exposing credentials through plain-text instruction files left in directories they examine, according to researchers who identified a blocked real-world attack and then reproduced related techniques under controlled conditions.
The investigation by Forever Security centred on an AGENTS.md file discovered in a customer's Downloads directory. The file attempted to instruct an AI coding agent to install a rogue npm package named function-color, which investigators associated with malware.
The customer's security controls blocked the attempted installation before the malicious code executed. The original incident therefore does not establish a successful compromise of that user's machine.
The researchers could not confirm how the file arrived, but examined the possibility that ordinary browser downloads could introduce such content into a location subsequently read by an agent. Browsers can save files to Downloads without those files being executable in their own right.
Files named AGENTS.md are often used legitimately to tell AI coding assistants about project structure, development conventions and permitted commands. Their usefulness depends on an agent treating instructions encountered during work as relevant operational guidance.
The attack exploited the gap between recognising a file as an instruction source and establishing who placed it there. A malicious text file can potentially acquire influence when an assistant is launched from an untrusted directory.
In controlled tests against Codex, Forever Security reported success in more than 90% of attempts using the reconstructed technique. The researchers separately tested malicious behaviour in an isolated virtual machine rather than allowing the real customer's attempted infection to complete.
Additional experiments involving Claude Code used a different instruction file and attempted changes to configuration associated with authentication. Success rates and prerequisites differed between products, so they should not be treated as one universal exploit affecting every AI agent equally.
Samuel Hassine, CEO and Co-founder of Filigran, commented:
"Software that acts on your behalf will also act on anyone who can slip it a note. A plain text file in a Downloads folder told an AI coding agent to install malware. The researchers stopped it before any code ran, and they are right that there is nothing to patch. The agent read the instructions in its folder and obeyed, as it was built to do. Any web page can quietly save a file to Downloads. In tests the trick worked on Codex nine times out of ten. Run coding agents only inside the project they work on. Read any instruction file you did not write before an agent does. Keep approval prompts and sandboxes switched on. An AI agent is a new hire holding your keys. Decide what it may touch before it starts work."
The observation that the attack involves intended agent behaviour does not mean that software developers cannot improve the trust boundaries around instruction loading. The problem concerns the combination of file discovery, model instruction handling, granted permissions and opportunities for approval.
An agent launched from a general-purpose Downloads folder may encounter unrelated and untrusted content. Even a narrower working directory does not necessarily prevent access to global configuration or credentials if broader permissions have been granted.
Jamie Akhtar, CEO and Co-founder of CyberSmart, also commented:
"The discovery that AI coding agents can be hijacked through malicious instruction files is a concerning reminder of the new cybersecurity risks emerging alongside AI adoption. Researchers demonstrated how attackers could manipulate tools such as OpenAI Codex and Claude Code into installing malicious software or exposing sensitive credentials, simply by placing a deceptive file in a folder the AI agent accesses. What's particularly concerning is that these attacks exploit the way AI tools are designed to operate, rather than traditional software vulnerabilities. As businesses increasingly rely on AI to improve productivity, it's essential they understand the potential security implications.
For businesses, this highlights the importance of treating AI tools with the same caution as any other system with access to sensitive information. Organisations should restrict AI agents' access to files and systems, avoid running them from folders containing untrusted downloads, and ensure security controls and approval processes remain enabled. Employee training is equally important, helping staff recognise the risks associated with AI tools and understand how to use them safely. Ultimately, adopting AI securely requires businesses to balance innovation with strong cybersecurity practices to prevent new technologies from becoming an entry point for attackers."
The mechanism differs from exploiting a conventional software defect. A successful attacker persuades an automated assistant to treat lower-trust content as instructions and then use capabilities that the assistant was legitimately given.
Those capabilities increasingly extend to repositories, package managers, terminals and external services. If an instruction file can influence a task beyond its intended context, even ordinary local content can become a route into operational authority.
The real customer incident was stopped before malware execution, while the laboratory exercises demonstrated agent manipulation under defined conditions. Those outcomes establish a concrete instruction-trust problem without proving that every deployment of Codex or Claude Code is equally vulnerable.
