The attack exploits instruction files that AI coding tools use to understand project requirements. OpenAI Codex supports AGENTS.md, while Claude Code can read CLAUDE.md. These plain-text files typically contain legitimate guidance about coding standards, project setup and development workflows.
However, an attacker can disguise harmful instructions as ordinary engineering documentation. When an AI agent opens the affected directory, it may interpret those instructions as trusted guidance and execute commands using its existing permissions.
Forever securities discovered a malicious AGENTS.md file in a customer's Downloads folder that instructed Codex to install a suspicious npm package called function-color. The security system stopped the installation before the malware could execute.
Although investigators could not establish how the original file reached the computer, they demonstrated that a malicious website could trigger a similar download without a separate approval prompt in certain browser configurations.
Forever Security reproduced related attacks against two widely used AI coding assistants.
In Codex experiments, the malicious instructions attempted to modify the agent's machine-wide configuration, register an external Model Context Protocol (MCP) server and install the malicious package. Because the configuration applied beyond the original working directory, the change could potentially affect subsequent sessions.
Researchers reported that Codex followed the malicious instructions in more than 90% of their tests, most of which used a harmless substitute for the malware.
The Claude Code demonstration used a different technique. A malicious CLAUDE.md file instructed the agent to redirect its API traffic to a researcher-controlled server. This could expose authentication tokens and allow the server to return instructions that the agent might execute.
The configuration change succeeded in approximately half of the tests, according to the researchers. These results are specific to their experimental setups and have not been independently validated.
Traditional malware typically relies on executable files, software vulnerabilities or users running malicious programs. This technique takes a different approach: it exploits the instructions an AI agent is designed to follow.
The Markdown files themselves do not need to contain executable code. Instead, they persuade the agent to perform dangerous actions using its existing access to files, terminals, configuration settings and external services.
This creates a significant security challenge. An AI assistant may be functioning as designed when it follows a project instruction, yet the instruction itself can be malicious.
The risk increases when developers allow agents to run commands autonomously, access sensitive credentials or modify configuration files without independent approval.
Developers and organizations can reduce the risk by making a few changes to their workflows:
The incident highlights a broader issue as AI agents gain more autonomy. Their usefulness depends on reading documentation, interacting with tools and carrying out multi-step tasks, but those same capabilities can create opportunities for attackers.
Security teams must therefore assess more than conventional executable malware. Project documentation, downloaded files, third-party packages and agent configuration settings can all influence what an AI assistant does.
The safest approach is to separate instructions from permissions. An agent may read a file to understand a task, but that file should not be allowed to authorize changes to security controls or grant access to sensitive information.
Malicious downloads demonstrate how attackers can turn AI coding assistants into tools for compromising their own environments. By exploiting trusted instruction files, researchers showed how Codex and Claude Code could potentially be manipulated into installing malware, redirecting API traffic or exposing authentication credentials.
The findings do not mean every AI coding session is vulnerable to successful exploitation, but they highlight the importance of secure working directories, reviewed instructions and restricted permissions.
As AI-powered development becomes more common, keeping agents isolated, verifying dependencies and requiring approval for sensitive actions will be essential to protecting developers and their projects.