Malicious instruction files can steer AI coding agents, researchers warn

A file saved from a website into Downloads could trick an AI coding agent into installing a malicious package or exposing a login token, according to security researchers at Forever Security. Their report describes tests involving OpenAI Codex and Anthropic Claude Code, and gives developers practical steps to reduce the risk.

Watch Desk analysis

What happened

The researchers say a planted AGENTS.md file, which coding agents are designed to follow as project instructions, prompted Codex to change its settings and install a package when it was opened in Downloads. They say the package was stopped by the company’s software on a customer’s computer. In their testing, Codex followed the instructions in more than 90% of attempts; most tests used a harmless stand-in, and the malicious package was run once in an isolated virtual machine.

The researchers also describe a separate test involving Claude Code. They say a crafted CLAUDE.md file could redirect requests and expose a user’s login token. Forever Security’s researchers reported that this succeeded in about half of their tests. Help Net Security reports the findings and notes the researchers say npm has since removed the package involved in the Codex case.

Why it matters

These are researchers’ reported findings, not evidence that every coding agent or every downloaded instruction file is dangerous. But the issue is worth taking seriously because plain-text files do not trigger the same operating-system warning as downloaded programmes, while coding agents may treat project instructions as trusted guidance.

The researchers’ advice is straightforward: do not start a coding agent in Downloads; read unfamiliar AGENTS.md or CLAUDE.md files before letting an agent use them; and check settings for servers or web addresses you did not add. Keep approval prompts and sandboxes enabled. If you find a planted file, they advise replacing the login token; they say a computer where the package was installed should be treated as compromised.

Our read

The useful lesson is less “never use coding agents” than “a folder can be part of the security boundary”. A file that looks like routine project guidance may carry instructions an agent is built to obey. Check unfamiliar files and keep the safeguards on, especially when an agent is working unattended. That is not glamorous security advice, but neither is explaining later why a text file got the keys.

What to watch

• Whether OpenAI and Anthropic publish guidance or changes in response to the researchers’ findings.
• Whether other security teams reproduce the reported attack paths.
• Whether coding tools make the source and effect of project instructions clearer to users.

Discussion spark: Should coding agents ever follow instruction files they find in Downloads automatically, or should that always require explicit user approval?

Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.