Malicious downloads can trick AI coding agents into compromising themselves

Publisher excerpt From CSO Online

Malicious instruction files planted in a computer’s Downloads folder can trick AI coding agents into executing harmful code or exposing authentication tokens, Forever Security said after blocking an attempted attack on a customer’s machine and demonstrating similar techniques against OpenAI’s Codex and Anthropic’s Claude Code. In its research report, the firm said it discovered a malicious AGENTS.md file in a customer’s Downloads folder that instructed Codex to install a malicious npm package called function-color. The installation was blocked before the malware could execute. The researchers could not determine how the original file reached the computer, but demonstrated that a malicious website could trigger a similar download without a separate approval prompt. The attack exploits the way AI coding assistants process project-specific instructions. Codex uses AGENTS.md, while Claude Code supports CLAUDE.md. Both can interpret instructions contained in these Markdown files when operating in directories where the files are present. The attack requires the agent to operate in the affected directory and process the malicious file. For Codex, the directory must also be trusted, according to Forever Security. In tests using the file recovered from the customer’s machine, Forever Security found that Codex could be manipulated into modifying its machine-wide MCP server configuration and launching another session with approval and sandbox restrictions bypassed. Codex followed…

Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.