-
Forever Security traced a blocked malware install to a harmful AGENTS.md file on a customer’s computer.
-
Tests showed Codex could install malware, while Claude Code could leak login tokens through changed settings.
-
Researchers advise developers to keep coding agents away from Downloads folders and check unfamiliar instruction files.
Cybersecurity researchers have warned that plain text files can put AI coding agents at risk. These files look harmless. Yet they can trick the agents into changing settings, installing malware, or leaking login tokens. The agents treat the words inside as orders.
The warning follows an investigation by Forever Security. The company shared its findings in a public blog post. The company stopped an AI coding agent on a customer’s computer from installing function-color, a harmful npm package. Privacy concerns have also emerged around other AI agents, including Meta’s Muse AI agent, which reportedly shared a user’s home address.
Investigators traced the install attempt to an AGENTS.md file in the customer’s Downloads folder. The company later copied related attacks against OpenAI Codex and Anthropic’s Claude Code in controlled tests.
Attacks can hide harmful instructions amid these files, report says
The findings therefore come from one real case and several lab experiments. Each tool reads its project instructions from its own file. An AGENTS.md file holds instructions that AI coding agents can follow while they work on a project. Claude Code uses a similar file called CLAUDE.md. Attackers can abuse these files. They disguise harmful orders as normal development rules.
According to Forever Security, researchers could not learn how the original file reached the customer’s computer. They did show that a website could quietly drop a similar file into a Downloads folder. This worked only under certain browser conditions. That proves a possible delivery path. It does not prove the attackers used it in the original case.
Codex and Claude code fall to different tricks in lab tests
Forever Security ran the tests to see how each agent would react to a hidden order. It reported that Codex followed harmful instructions in more than 90% of its tests. The file pushed the agent to edit ~/.codex/config.toml, a settings file that shapes future Codex sessions. The agent then installed the harmful package. That means Codex obeyed in more than nine of every ten runs.
That settings change could let the attacker’s server load in later sessions. The danger could then spread beyond the first folder. Separately, Checkmarx documented the MALFEX npm malware campaign. The campaign includes function-color and a related downloader named function-flag.
The Claude Code attack took a different path. Researchers wrote a harmful CLAUDE.md file. It told Claude to change its API address by setting ANTHROPIC_BASE_URL. This setting decides where Claude sends its requests. That sent Claude’s requests to a server the researchers controlled. The server then captured the OAuth token, which works as a login pass. The service uses this token to confirm who the user is.
Forever Security said Claude followed the settings instructions in about half of its tests. That equals roughly one success in every two tries. Researchers said they could replay a captured token. That let them reach Anthropic’s service as the victim. They also reported a follow-up trick that ran code in roughly one-fifth of tests.
The findings do not mean an opened text file automatically takes over an AI agent. The attack needs two things to work, according to the report. The agent must process the harmful instructions. It must also have enough permission to make the changes or run commands.
Developers on X push for tighter limits on coding agents
Reports say independent coverage backs the central claims of the research. The same reports note that the delivery method of the original file remains unknown.
Several people on X also raised worries about instruction files and extra permissions. According to Sagnik Ghosh (@sagnik_ghosh_11), agents should never load instruction files from outside the repository root. He also wants a human to approve every settings change and package install.
Edgar Cabrera (@edgarcabrera_) asked developers to run coding agents in throwaway, sealed-off sessions. AyCode (@AyCodeAI) agreed and said instruction files deserve the same distrust as any unknown input. AyCode added that package installs need a clear approval step.
Other users focused on the danger of broad access. Yash Kapoor (@IamYashKapoor) warned developers against starting an agent from the home directory. Artyom (@sklyarov) urged developers to limit agents to chosen projects and keep secrets out of reach. Morne (@Loopworksio) disagreed in part. He said weak security habits and too many permissions also drive the risk.
Security researchers advise developers to keep coding agents away from Downloads folders. They also gave clear steps to follow. Developers should run coding agents only in the intended project directory. They should read unfamiliar AGENTS.md and CLAUDE.md files before use.
Approval prompts and sandbox protections should stay switched on. Developers should also look for odd MCP server entries in Codex settings. They should check Claude settings for unfamiliar API addresses. Anyone who finds signs of this attack should isolate the affected system first. Next, they should look for malware on it. They should then cancel any exposed tokens and passwords from a clean device.
