Cybersecurity researchers have identified a new attack method aimed at developers who rely on automated AI coding assistants. Malicious instruction files placed in local directories can manipulate these agents into running harmful commands and installing unauthorized software packages.
A recent report from security firm Forever Security says the approach exploits a core design trait of modern coding tools. Agents such as OpenAI's Codex and Anthropic's Claude Code are deliberately programmed to read and follow plain-text direction files, like AGENTS.md or CLAUDE.md, whenever they start in a workspace folder.
Forever stopped a coding agent, mid-session, from installing function-color, a known malicious npm package from a campaign that flew under the radar for roughly two years, until it was caught and documented publicly. Blocking a known-bad package is ordinary, so the team looked closer. One thing was odd: where the order came from. Not a dependency. Not a code repository. The customer's ~/Downloads folder. We traced it back. The agent had not gone looking for malware. It was following an AGENTS.md file left in that folder, the kind of file Codex reads on startup and obeys.
Because web browsers can silently save files to a user's Downloads folder without prompting for permission, attackers can drop malicious instructions into a directory the agent automatically trusts.
In tests, researchers showed that when Codex was launched in a compromised folder, it obeyed the hidden directives more than ninety percent of the time. The planted instructions caused the agent to register an unauthorized server in global configuration files and install malicious npm packages.
Against Claude Code, the attack succeeded less often, as human approval prompts frequently caught suspicious changes, but it still bypassed defenses in roughly half of the trials.
Industry experts note that the vulnerability does not arise from a software bug in OpenAI or Anthropic products. The risk stems from agents operating as intended, blindly trusting instructions found in local environments. Telemetry data also shows that many developers often start coding agents directly from their Downloads directories while browsing the web.
To reduce this emerging risk, security professionals suggest practical steps: avoid launching coding agents inside the Downloads folder, regularly inspect configuration files for unauthorized server entries or altered base URLs, and carefully review any unfamiliar Markdown instruction files before allowing automated tools to run commands in a project repository.
We caught this one because we were watching the agent, not the user. The next attack will not look like this one - and anyone still watching only the user will miss it too.
As AI becomes more embedded in software development pipelines, protecting local execution environments remains vital for endpoint security and for safeguarding sensitive API credentials against sophisticated supply-chain threats.
