By Prasanth Aby Thomas

As software development increasingly relies on autonomous artificial intelligence agents to accelerate coding workflows, a newly uncovered class of vulnerabilities exposes a fundamental architectural flaw in how these tools operate. Security researchers have revealed that trusted instruction files—standard components used to guide popular AI coding assistants—can be weaponized by malicious actors. By planting these rogue configurations into unsuspecting directories, attackers can trick AI agents into executing arbitrary code, hijacking API traffic, installing hidden malware, and systematically dismantling built-in security safeguards.

The discovery highlights an alarming blind spot in the modern developer’s toolkit. Tools designed to boost productivity are being turned into insider threats through indirect prompt injection, exploiting the trust relationship between human developers and their AI assistants.

1. Main Facts: The Anatomy of an AI Supply Chain Threat

The core of the issue lies in how modern AI coding assistants—such as OpenAI’s Codex and Anthropic’s Claude Code—interact with project-specific documentation. These systems are programmed to read and follow project instructions stored in plain Markdown files located within working directories. For instance, Codex relies on AGENTS.md, while Claude Code utilizes CLAUDE.md.

These files contain no executable code themselves. Instead, they rely on natural language instructions that the AI agent interprets as authoritative guidelines. If an agent is granted broad local permissions, it will faithfully execute the tasks outlined in these Markdown files as if they were commanded by the human developer.

Security firm Forever Security first brought this issue to light after intercepting an attempted attack on a client’s machine. Researchers discovered a malicious AGENTS.md file planted deep within the user’s Downloads folder. The file was engineered to instruct Codex to silently download and install a malicious npm package named function-color. While the security firm successfully blocked the installation before the malware could execute, the incident prompted a deeper investigation into the broader implications of file-based prompt manipulation.

Subsequent testing by Forever Security revealed alarming success rates:

• Codex Compliance: When subjected to testing using the recovered malicious file, Codex followed the rogue instructions in over 90% of trials, executing unauthorized modifications to machine-wide configurations.
• Claude Code Compromise: Tests against Claude Code demonstrated that malicious instructions could successfully redirect API traffic to attacker-controlled servers, exposing sensitive authentication tokens and enabling remote command execution in roughly half of the test scenarios.

2. Chronology of Discovery and Testing

The timeline of this vulnerability spans from initial detection in the wild to simulated exploitation in controlled security environments:

• The Initial Incident: Forever Security monitors a client’s environment and detects an unauthorized, malicious AGENTS.md file placed inside the local Downloads directory. The file contains embedded instructions designed to pull malicious Node.js packages. Security systems flag and block the installation.
• Attack Vector Analysis: Unable to determine the exact delivery mechanism of the initial file, researchers test browser and file-system behaviors. They demonstrate that a malicious website can trigger the silent download of these instruction files directly into targeted directories without prompting the user for explicit approval.
• Replication and Stress Testing: Researchers replicate the attack vector against OpenAI’s Codex and Anthropic’s Claude Code. They evaluate how the agents process project files when operating within trusted directories.
• Persistent Configuration Tampering: During Codex trials, researchers observe that the AI can be manipulated into altering machine-wide Model Context Protocol (MCP) server configurations. Because these settings are persistent, the malicious configurations load even after the developer switches to entirely different project directories.
• Token Exfiltration and Replay: During Claude Code trials, researchers successfully redirect API traffic, capture valid OAuth tokens, and replay them against legitimate APIs, proving that attackers can achieve full account and session compromise.

3. Supporting Data and Technical Mechanics

The mechanics of the exploit rely heavily on psychological and operational manipulation of the AI agent rather than traditional software exploitation.

The Trust Trajectory

AI coding assistants are built to be helpful, cooperative, and responsive to context. When an agent boots up in a directory, it scans for context files like AGENTS.md or CLAUDE.md to understand project rules, coding standards, and libraries. Because these files are treated as administrative guides, the boundary between "helpful instruction" and "system command" blurs entirely.

Persistence via MCP Configuration

One of the most dangerous findings from Forever Security’s research involves the manipulation of Model Context Protocol (MCP) servers. In tests, Codex was tricked into rewriting its machine-wide configuration files to register a rogue MCP server.

This introduces a persistent backdoor. Even if the user deletes the malicious instruction file and navigates to a completely clean project directory, the compromised machine-wide configuration remains active, loading the malicious server on subsequent sessions.

API Traffic Redirection and Credential Harvesting

In trials targeting Claude Code, the malicious CLAUDE.md file successfully instructed the agent to pivot its network requests away from official endpoints toward a researcher-controlled intermediary server. This man-in-the-middle positioning achieved two critical objectives:

1. It exposed live authentication tokens and session keys.
2. It allowed the attacker-controlled server to stream arbitrary terminal commands back to the AI agent for local execution.

Researchers successfully captured these OAuth tokens and replayed them against legitimate enterprise APIs, validating that the stolen credentials retained full operational validity.

4. Official Responses and Industry Expert Analysis

The cybersecurity community has reacted to the findings with a mix of urgency and calls for foundational architectural reform.

Sakshi Grover, senior research manager for cybersecurity products and services for Asia/Pacific at IDC, categorized the research as a critical early warning rather than an indicator of widespread systemic exploitation. However, she emphasized that the success rates demonstrated in the lab are concerning and highlight a major oversight in agent design.

"The more consequential risk is not Downloads specifically but the broader pattern of agents ingesting untrusted content and holding live credentials," Grover warned. She suggested that software vendors must begin verifying the cryptographic origin of instruction files and require explicit user consent before loading configurations from unverified locations.

Akshat Tyagi, associate practice leader at HFS Research, pointed to a deeper architectural flaw in how AI systems process authority:

"The deeper issue is that these tools treat following an instruction and granting a privilege as the same act," Tyagi stated. He argued that AI vendors must decouple operational instructions from privilege escalation, ensuring that no Markdown file can unilaterally alter security controls without direct, manual human authorization.

Meanwhile, enterprise security metrics indicate that organizations are ill-equipped to handle these emergent risks. According to an Omdia Cybersecurity Decision-Maker survey cited by senior managed security services analyst Jonathan Ong, 40% of enterprise respondents are only somewhat confident—or entirely unconfident—in their organization’s ability to secure autonomous AI agents.

5. Implications and Strategic Defense for Enterprises

As autonomous agents become permanent fixtures in software engineering, the attack surface surrounding developer environments is expanding rapidly. Attackers are no longer just targeting compiled binaries or source code repositories; they are targeting the cognitive loop of the developer’s assistant.

Beyond the Downloads Folder

While the initial vector analyzed by Forever Security involved the Downloads folder, the underlying technique can easily be adapted to other common entry points. Cloned Git repositories from public forges, shared network drives, compromised software dependencies, and malicious package contents can all serve as delivery mechanisms for rogue AGENTS.md or CLAUDE.md files.

Hardening AI Coding Environments

To mitigate these risks, security leaders and engineering managers must implement strict guardrails around how AI assistants are deployed and permitted to run:

1. Enforce Strict Human Oversight: Jonathan Ong of Omdia recommends actively monitoring agent behaviors for anomalies and disabling dangerous execution flags. "Disabling flags such as --dangerously-bypass-approvals-and-sandbox would limit the agent’s authorization to run high-risk actions," Ong advised.
2. Treat Configuration Files as Source Code: Amit Kumar Jena, development manager for AI at Kanerika, suggests treating agent instruction files with the same rigorous governance applied to production codebases. Designated code owners should review any modifications made to AGENTS.md, CLAUDE.md, and related configuration directories through standard pull-request workflows.
3. Isolate Development Environments: Developers handling production credentials should operate within sandboxed, ephemeral development environments. Network access for AI tools should be strictly bottlenecked through internal proxies and software registries.
4. Short-Lived Authentication Tokens: Enterprises must transition away from long-lived OAuth tokens and credentials residing on local developer machines, favoring short-lived, enterprise-managed tokens.

As Amit Kumar Jena aptly summarized:

"An instruction file can change what the agent tries. It must never change what the agent is allowed to do."

Until AI vendors redesign their products to separate prompt instruction from system-level privileges, the burden falls squarely on enterprises to lock down their developer environments against the silent threat of the hijacked assistant.