{"id":10162,"date":"2026-10-26T10:35:08","date_gmt":"2026-10-26T10:35:08","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=10162"},"modified":"2026-10-26T10:35:08","modified_gmt":"2026-10-26T10:35:08","slug":"malicious-downloads-can-trick-ai-coding-agents-into-compromising-themselves","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=10162","title":{"rendered":"Malicious downloads can trick AI coding agents into compromising themselves"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Malicious instruction files planted in a computer\u2019s Downloads folder can trick AI coding agents into executing harmful code or exposing authentication tokens, Forever Security said after blocking an attempted attack on a customer\u2019s machine and demonstrating similar techniques against OpenAI\u2019s Codex and Anthropic\u2019s Claude Code.<\/p>\n

In its research<\/a> report, the firm said it discovered a malicious AGENTS.md file in a customer\u2019s Downloads folder that instructed Codex to install a malicious npm package called function-color. The installation was blocked before the malware could execute.<\/p>\n

The researchers could not determine how the original file reached the computer, but demonstrated that a malicious website could trigger a similar download without a separate approval prompt.<\/p>\n

The attack exploits the way AI coding assistants process project-specific instructions. Codex uses AGENTS.md, while Claude Code supports CLAUDE.md. Both can interpret instructions contained in these Markdown files when operating in directories where the files are present.<\/p>\n

The attack requires the agent to operate in the affected directory and process the malicious file. For Codex, the directory must also be trusted, according to Forever Security.<\/p>\n

In tests using the file recovered from the customer\u2019s machine, Forever Security found that Codex could be manipulated into modifying its machine-wide MCP server configuration<\/a> and launching another session with approval and sandbox restrictions bypassed.<\/p>\n

Codex followed the malicious instructions in more than 90% of tests, most of which used a harmless substitute for the malware. Because the malicious server was registered in Codex\u2019s machine-wide configuration, it could also be loaded in subsequent sessions, even after the developer moved to another directory.<\/p>\n

A separate demonstration against Claude Code showed that a malicious CLAUDE.md file could redirect the agent\u2019s API traffic to a researcher-controlled server, exposing authentication tokens and allowing the server to supply commands for execution. The configuration manipulation succeeded in approximately half of the tests.<\/p>\n

The researchers also successfully replayed a captured OAuth token<\/a> against the legitimate API, demonstrating the potential for account compromise.<\/p>\n

The Markdown files contain no executable code. Instead, the attack relies on an AI agent interpreting their contents<\/a> as legitimate instructions and carrying them out with its existing permissions.<\/p>\n

Commenting on Forever Security\u2019s findings, Sakshi Grover<\/a>, senior research manager for cybersecurity products and services for Asia\/Pacific at IDC, said the research was a credible early warning rather than evidence of widespread exploitation. She noted that the reported success rates varied between agents and had not been independently validated.<\/p>\n

An architectural weakness<\/h2>\n

The findings expose a broader design problem in AI coding agents, which are expected to follow project instructions but may also have access to sensitive configurations and execution privileges, according to Akshat Tyagi<\/a>, associate practice leader at HFS Research.<\/p>\n

\u201cThe deeper issue is that these tools treat following an instruction and granting a privilege as the same act,\u201d Tyagi said.<\/p>\n

He argued that vendors must separate the two, ensuring that instructions from project files cannot authorize changes to an agent\u2019s security settings without independent human approval.<\/p>\n

Grover said vendors should verify the origin of instruction files and require explicit approval before loading those from untrusted sources, rather than automatically treating them as authoritative.<\/p>\n

Attackers could adapt the technique to other locations accessible to coding agents, including cloned repositories, shared drives, and package contents.<\/p>\n

\u201cThe more consequential risk is not Downloads specifically but the broader pattern of agents ingesting untrusted content and holding live credentials,\u201d Grover said.<\/p>\n

Securing AI coding agents<\/h2>\n

The findings come amid uncertainty over enterprises\u2019 ability to secure autonomous agents. An Omdia Cybersecurity Decision-Maker survey found that 40% of respondents were only somewhat confident or not confident in their organizations\u2019 ability to secure AI agents, according to Jonathan Ong<\/a>, senior analyst for managed security services at Omdia.<\/p>\n

Ong recommended human oversight to identify suspicious agent behavior and restrictions on settings that allow agents to bypass security controls.<\/p>\n

\u201cDisabling flags such as \u2018\u2013dangerously-bypass-approvals-and-sandbox\u2019 would limit the agent\u2019s authorization to run high-risk actions,\u201d Ong said.<\/p>\n

Amit Kumar Jena<\/a>, development manager for AI at Kanerika, recommended treating agent instruction files like source code, with designated owners reviewing changes to AGENTS.md, CLAUDE.md and related configuration directories.<\/p>\n

He also advised keeping sandboxes enabled, restricting network access, and routing software installations through internal package registries or scanning proxies. For developers with production credentials on their machines, he recommended isolated development environments and enterprise-controlled gateways with shorter-lived authentication tokens. \u201cAn instruction file can change what the agent tries,\u201d Jena said. \u201cIt must never change what the agent is allowed to do.\u201d<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

Malicious instruction files planted in a computer\u2019s Downloads folder can trick AI coding agents into executing harmful code or exposing authentication tokens, Forever Security said after blocking an attempted attack on a customer\u2019s machine and demonstrating similar techniques against OpenAI\u2019s Codex and Anthropic\u2019s Claude Code. In its research report, the firm said it discovered a […]<\/p>\n","protected":false},"author":0,"featured_media":10163,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-10162","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10162"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10162"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10162\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/10163"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10162"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10162"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10162"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}