Cybersecurity researchers have uncovered a novel attack vector targeting developers who utilize automated artificial intelligence coding assistants. Malicious instruction files quietly planted inside local directories can successfully manipulate AI agents into executing harmful commands and installing unauthorized software packages.
According to a recent report from security firm Forever Security, the technique exploits a fundamental design characteristic of modern coding tools. Agents like OpenAI’s Codex and Anthropic’s Claude Code are intentionally built to read and obey plain-text direction files (such as AGENTS.md or CLAUDE.md) whenever they are initialized within a workspace folder.
As the security firm explains:
Forever stopped a coding agent, mid-session, from installing
function-color, a known malicious npm package from a campaign that flew under the radar for roughly two years, until it was caught and documented publicly. Blocking a known-bad package is ordinary, so the team looked closer. One thing was odd: where the order came from. Not a dependency. Not a code repository. The customer’s~/Downloadsfolder. We traced it back. The agent had not gone looking for malware. It was following anAGENTS.mdfile left in that folder, the kind of file Codex reads on startup and obeys.
Because web browsers can silently save files directly to a user’s Downloads folder without triggering permission prompts, attackers can drop malicious instructions into a directory the agent implicitly trusts.
During testing, researchers demonstrated that when Codex was initialized in a compromised folder, it followed the hidden directives over ninety percent of the time. The planted instructions tricked the agent into registering an unauthorized server inside global configuration files and installing malicious npm packages.
Against Claude Code, the attack achieved a lower success rate because human approval prompts often caught suspicious modifications, but it still successfully bypassed defenses in roughly half of the trials.
Industry experts emphasize that this vulnerability does not stem from a software bug in products built by OpenAI or Anthropic. Instead, the risk arises from agents operating exactly as designed by blindly trusting instructions found within local environments. Furthermore, telemetry data indicates that a significant percentage of developers frequently launch coding agents directly out of their Downloads directories while simultaneously browsing the web.
To mitigate this emerging risk, security professionals recommend several practical precautions. Developers should avoid launching coding agents inside the Downloads folder, routinely inspect configuration files for unauthorized server additions or modified base URLs, and carefully review any unfamiliar Markdown instruction files before letting automated tools execute commands within a project repository.
Forever Security concluded their report with a warning:
We caught this one because we were watching the agent, not the user. The next attack will not look like this one – and anyone still watching only the user will miss it too.
As artificial intelligence integration deepens across software development pipelines, safeguarding local execution environments remains an essential priority for maintaining endpoint security and protecting sensitive API credentials against sophisticated supply chain threats today.
