AI Coding Agents Tricked Into Executing Malicious Instructions

AI coding assistants, including OpenAI’s Codex and Anthropic’s Claude Code, can be manipulated into executing malicious commands and exposing sensitive credentials through specially crafted instruction files.

Research from Forever Security found that attackers can plant malicious Markdown files, such as AGENTS.md or CLAUDE.md, in directories where these agents operate. When a developer triggers the agent in a folder containing these files, the AI interprets the contents as legitimate project instructions and carries them out with its existing permissions.

The technique was identified after Forever Security blocked an attempted attack on a customer’s machine. The researchers discovered a malicious file in a Downloads folder that instructed Codex to install a malicious npm package. While the installation was blocked, further testing showed that malicious websites could trigger similar file downloads without requiring a separate approval prompt from the user.

Bypassing Sandboxes and Stealing Tokens

In experimental tests, Codex followed the malicious instructions in more than 90% of cases. The researchers successfully manipulated the agent into modifying its machine-wide configuration, allowing it to launch subsequent sessions with security restrictions and sandbox protections bypassed. Because these changes were made to the machine-wide settings, the compromise persisted even after the developer moved to a different directory.

A separate demonstration against Anthropic’s Claude Code showed that a malicious instruction file could redirect the agent’s API traffic to a server controlled by attackers. This allowed the researchers to capture OAuth authentication tokens and replay them against the legitimate API to compromise the account. This configuration manipulation succeeded in approximately half of the researchers’ tests.

Architectural Flaws in Autonomous Agents

The findings highlight a fundamental design issue in the current generation of autonomous AI agents. Security experts noted that these tools often fail to distinguish between following a project instruction and granting a high-level privilege. Currently, many agents treat both actions as the same act, allowing untrusted files to authorise changes to security settings without independent human approval.

While this research serves as an early warning rather than evidence of widespread exploitation, it exposes a broader risk pattern. Attackers could adapt this technique to target other locations accessible to coding agents, including cloned repositories, shared drives, and the contents of software packages.

Recommended Mitigations for Developers

To secure AI-assisted development environments, researchers and industry analysts recommend implementing strict human oversight for all agent-led actions. Organisations should consider disabling flags that allow agents to bypass sandbox restrictions or security approvals by default.

Additional security measures include:

• Treating agent instruction files like source code and requiring manual review for any changes.
• Restricting network access for AI agents to prevent data exfiltration.
• Using isolated development environments for developers who handle production credentials.
• Routing all software installations through internal package registries or scanning proxies.

As AI agents become more autonomous, security models must ensure that an instruction file can change what an agent attempts to do, but never what it is authorised to do.