{"slug": "how-malicious-downloads-can-trick-ai-coding-agents-into-compromising-themselves", "title": "How malicious downloads can trick AI coding agents into compromising themselves", "summary": "Forever Security reported that malicious AGENTS.md and CLAUDE.md files planted in a computer's Downloads folder can trick AI coding agents into executing harmful code or exposing authentication tokens, after the firm blocked an attempted attack on a customer's machine and reproduced the technique against OpenAI's Codex and Anthropic's Claude Code. Codex followed the malicious instructions in more than 90% of tests, including modifying its machine-wide MCP server configuration and launching a session with approval and sandbox restrictions bypassed, while a malicious CLAUDE.md redirected Claude Code's API traffic to a researcher-controlled server and exposed authentication tokens in approximately half of tests. IDC senior research manager Sakshi Grover called the research a credible early warning rather than evidence of widespread exploitation, and HFS Research associate practice leader Akshat Tyagi said \"the deeper issue is that these tools treat following an instruction and granting a privilege as the same act.", "body_md": "Malicious instruction files planted in a computer’s Downloads folder can trick AI coding agents into executing harmful code or exposing authentication tokens, Forever Security said after blocking an attempted attack on a customer’s machine and demonstrating similar techniques against OpenAI’s Codex and Anthropic’s Claude Code.\n\nIn its [research](https://forever.security/blog/hijacking-ai-agents-via-downloads-folder) report, the firm said it discovered a malicious AGENTS.md file in a customer’s Downloads folder that instructed Codex to install a malicious npm package called function-color. The installation was blocked before the malware could execute.\n\nThe researchers could not determine how the original file reached the computer, but demonstrated that a malicious website could trigger a similar download without a separate approval prompt.\n\nThe attack exploits the way AI coding assistants process project-specific instructions. Codex uses AGENTS.md, while Claude Code supports CLAUDE.md. Both can interpret instructions contained in these Markdown files when operating in directories where the files are present.\n\nThe attack requires the agent to operate in the affected directory and process the malicious file. For Codex, the directory must also be trusted, according to Forever Security.\n\nIn tests using the file recovered from the customer’s machine, Forever Security found that Codex could be manipulated into modifying its [machine-wide MCP server configuration](https://www.csoonline.com/article/4089046/rogue-mcp-servers-can-take-over-cursors-built-in-browser.html) and launching another session with approval and sandbox restrictions bypassed.\n\nCodex followed the malicious instructions in more than 90% of tests, most of which used a harmless substitute for the malware. Because the malicious server was registered in Codex’s machine-wide configuration, it could also be loaded in subsequent sessions, even after the developer moved to another directory.\n\nA separate demonstration against Claude Code showed that a malicious CLAUDE.md file could redirect the agent’s API traffic to a researcher-controlled server, exposing authentication tokens and allowing the server to supply commands for execution. The configuration manipulation succeeded in approximately half of the tests.\n\nThe researchers also successfully replayed a [captured OAuth token](https://www.csoonline.com/article/4181230/claude-code-has-an-mcp-security-problem-and-your-developers-are-already-using-it.html) against the legitimate API, demonstrating the potential for account compromise.\n\nThe Markdown files contain no executable code. Instead, the attack relies on an AI agent [interpreting their contents](https://www.csoonline.com/article/4184455/prompt-injection-breaks-todays-ai-agents-study-warns.html) as legitimate instructions and carrying them out with its existing permissions.\n\nCommenting on Forever Security’s findings, [Sakshi Grover](https://my.idc.com/getdoc.jsp?containerId=PRF005665), senior research manager for cybersecurity products and services for Asia/Pacific at IDC, said the research was a credible early warning rather than evidence of widespread exploitation. She noted that the reported success rates varied between agents and had not been independently validated.\n\nThe findings expose a broader design problem in AI coding agents, which are expected to follow project instructions but may also have access to sensitive configurations and execution privileges, according to [Akshat Tyagi](https://www.hfsresearch.com/team/akshat-tyagi/), associate practice leader at HFS Research.\n\n“The deeper issue is that these tools treat following an instruction and granting a privilege as the same act,” Tyagi said.\n\nHe argued that vendors must separate the two, ensuring that instructions from project files cannot authorize changes to an agent’s security settings without independent human approval.\n\nGrover said vendors should verify the origin of instruction files and require explicit approval before loading those from untrusted sources, rather than automatically treating them as authoritative.\n\nAttackers could adapt the technique to other locations accessible to coding agents, including cloned repositories, shared drives, and package contents.\n\n“The more consequential risk is not Downloads specifically but the broader pattern of agents ingesting untrusted content and holding live credentials,” Grover said.\n\nThe findings come amid uncertainty over enterprises’ ability to secure autonomous agents. An Omdia Cybersecurity Decision-Maker survey found that 40% of respondents were only somewhat confident or not confident in their organizations’ ability to secure AI agents, according to [Jonathan Ong](https://omdia.tech.informa.com/authors/jonathan-ong), senior analyst for managed security services at Omdia.\n\nOng recommended human oversight to identify suspicious agent behavior and restrictions on settings that allow agents to bypass security controls.\n\n“Disabling flags such as ‘–dangerously-bypass-approvals-and-sandbox’ would limit the agent’s authorization to run high-risk actions,” Ong said.\n\n[Amit Kumar Jena](https://www.linkedin.com/in/znamit/), development manager for AI at Kanerika, recommended treating agent instruction files like source code, with designated owners reviewing changes to AGENTS.md, CLAUDE.md and related configuration directories.\n\nHe also advised keeping sandboxes enabled, restricting network access, and routing software installations through internal package registries or scanning proxies. For developers with production credentials on their machines, he recommended isolated development environments and enterprise-controlled gateways with shorter-lived authentication tokens. “An instruction file can change what the agent tries,” Jena said. “It must never change what the agent is allowed to do.”\n\n*The article originally appeared on [CSO](https://www.csoonline.com/article/4240222/malicious-downloads-can-trick-ai-coding-agents-into-compromising-themselves.html).*", "url": "https://wpnews.pro/news/how-malicious-downloads-can-trick-ai-coding-agents-into-compromising-themselves", "canonical_source": "https://www.infoworld.com/article/4240233/how-malicious-downloads-can-trick-ai-coding-agents-into-compromising-themselves.html", "published_at": "2026-10-26 10:40:38+00:00", "updated_at": "2026-10-26 11:46:46.151916+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-tools", "developer-tools"], "entities": ["Forever Security", "OpenAI", "Codex", "Anthropic", "Claude Code", "Sakshi Grover", "IDC", "Akshat Tyagi"], "also_reported_by": [{"url": "https://www.helpnetsecurity.com/2026/10/26/ai-coding-agents-malware-openai-codex/", "source": "helpnetsecurity.com", "title": "AI coding agents fall for malicious instructions planted in the Downloads folder", "published_at": "2026-10-26T11:26:40+00:00"}], "alternates": {"html": "https://wpnews.pro/news/how-malicious-downloads-can-trick-ai-coding-agents-into-compromising-themselves", "markdown": "https://wpnews.pro/news/how-malicious-downloads-can-trick-ai-coding-agents-into-compromising-themselves.md", "text": "https://wpnews.pro/news/how-malicious-downloads-can-trick-ai-coding-agents-into-compromising-themselves.txt", "jsonld": "https://wpnews.pro/news/how-malicious-downloads-can-trick-ai-coding-agents-into-compromising-themselves.jsonld"}}