Malicious AI Coding Agent Instructions Can Expose Credentials and Bypass Safeguards

AI coding agents can turn a plain Markdown file into a route to sensitive credentials and system settings. Forever Security says it blocked an attempted attack on a customer’s computer and reproduced related techniques against OpenAI Codex and Anthropic Claude Code.

The incident began with an AGENTS.md file in the customer’s Downloads folder. It told Codex to install a malicious npm package named function-color; security controls stopped the package before it ran. Researchers couldn’t establish how the file arrived, but showed that a malicious website could trigger a similar download without another approval prompt.

These files are designed to guide coding agents through project-specific instructions. Codex reads AGENTS.md, while Claude Code supports CLAUDE.md. The files contain no executable code: the risk comes from an agent interpreting their text as trusted direction and acting with its existing permissions.

Instructions can reach beyond a project

The attack depends on the agent working in the directory containing the malicious file. Codex also requires that directory to be trusted, Forever Security said.

Using the recovered file, researchers found that Codex could be prompted to alter its machine-wide MCP server configuration and start another session with approval and sandbox restrictions bypassed. Codex followed the instructions in more than 90% of tests, most of which substituted harmless behavior for malware. Because the server entry applied across the machine, later sessions could load it even after the developer changed directories.

In a separate Claude Code demonstration, a malicious CLAUDE.md file redirected API traffic to a server controlled by the researchers. That could expose authentication tokens and let the server return commands for the agent to run. The configuration change worked in about half of the tests. Researchers also replayed a captured OAuth token against the legitimate API, showing a path to account compromise.

Sakshi Grover, IDC’s senior research manager for cybersecurity products and services in Asia/Pacific, described the findings as a credible early warning, not evidence of widespread exploitation. She said the reported success rates differed by agent and hadn’t been independently validated.

The boundary between instruction and permission

For Akshat Tyagi, associate practice leader at HFS Research, the larger concern is how coding agents combine the ability to follow project instructions with access to sensitive configuration and execution privileges. “The deeper issue is that these tools treat following an instruction and granting a privilege as the same act,” he said.

That design leaves a gap: a project file can influence actions that change the agent’s own security settings. Tyagi said vendors should require separate human approval for those changes. Grover called for checking where instruction files came from and asking users before loading files from untrusted sources.

The same pattern could reach agents through cloned repositories, shared drives, or package contents. “The more consequential risk is not Downloads specifically but the broader pattern of agents ingesting untrusted content and holding live credentials,” Grover said.

Controls for teams using coding agents

Enterprise confidence remains uneven. An Omdia Cybersecurity Decision-Maker survey found that 40% of respondents were only somewhat confident or not confident that their organizations could secure AI agents, according to Jonathan Ong, Omdia senior analyst for managed security services.

Ong recommended human oversight for suspicious agent behavior and tighter limits on settings that bypass safeguards. “Disabling flags such as ‘–dangerously-bypass-approvals-and-sandbox’ would limit the agent’s authorization to run high-risk actions,” he said.

Amit Kumar Jena, development manager for AI at Kanerika, advised treating AGENTS.md, CLAUDE.md, and related configuration as source code, with named owners reviewing changes. He also recommended keeping sandboxes enabled, limiting network access, and routing software installs through internal package registries or scanning proxies.

For developers whose machines hold production credentials, Jena suggested isolated development environments and enterprise-controlled gateways that use shorter-lived tokens. His core distinction is practical: “An instruction file can change what the agent tries. It must never change what the agent is allowed to do.”