Security researchers have uncovered a vulnerability that allows attackers to manipulate AI coding assistants into installing malware and exposing authentication credentials. Forever Security discovered the attack method after blocking an attempted compromise on a customer's computer and then replicating similar techniques against OpenAI's Codex and Anthropic's Claude Code. The firm found that malicious instruction files placed in a computer's Downloads folder can trick these AI agents into executing harmful code or revealing authentication tokens.
The vulnerability exploits how AI coding assistants process project-specific instructions through Markdown files. According to the research, Codex relies on AGENTS.md files while Claude Code uses CLAUDE.md files, and both interpret commands contained in these files when working in directories where they're located. In testing with a malicious file recovered from the customer's machine, Forever Security found Codex followed harmful instructions in more than 90% of trials, most using a benign substitute for the actual malware. The agent could be manipulated into altering its machine-wide MCP server configuration and launching another session with approval and sandbox protections disabled. A separate demonstration against Claude Code showed a malicious CLAUDE.md file could reroute the agent's API traffic to a researcher-controlled server, exposing authentication tokens and enabling the server to issue commands for execution. The configuration manipulation worked in roughly half of the tests, and researchers successfully replayed a captured OAuth token against the legitimate API, showing the potential for account takeover.
The attack depends on AI agents interpreting the contents of Markdown files as legitimate instructions and executing them with existing permissions, even though the files contain no executable code themselves. The report notes that because the malicious server was registered in Codex's machine-wide configuration, it could be loaded in subsequent sessions even after the developer switched to a different directory. Sakshi Grover, senior research manager for cybersecurity products and services for Asia/Pacific at IDC, characterized the research as "a credible early warning rather than evidence of widespread exploitation," noting that the reported success rates varied between agents and hadn't been independently validated. Akshat Tyagi, associate practice leader at HFS Research, said "the deeper issue is that these tools treat following an instruction and granting a privilege as the same act," arguing that vendors must separate the two to ensure instructions from project files can't authorize changes to security settings without independent human approval.
The findings reveal a fundamental design flaw in AI coding agents, which are built to follow project instructions but may also hold access to sensitive configurations and execution privileges. Grover told the researchers that the more serious risk isn't the Downloads folder specifically but "the broader pattern of agents ingesting untrusted content and holding live credentials." She recommended that vendors verify the origin of instruction files and require explicit approval before loading those from untrusted sources. Attackers could adapt the technique to other locations accessible to coding agents, including cloned repositories, shared drives, and package contents. The report's authors recommend treating agent instruction files like source code, with designated owners reviewing changes to AGENTS.md, CLAUDE.md, and related configuration directories, while keeping sandboxes enabled and routing software installations through internal package registries or scanning proxies. Amit Kumar Jena, development manager for AI at Kanerika, summarized the core security principle: "An instruction file can change what the agent tries. It must never change what the agent is allowed to do." The vulnerability arrives as enterprises grapple with securing autonomous agents, with an Omdia survey finding that 40% of respondents were only somewhat confident or not confident in their organizations' ability to secure AI agents. Organizations relying on AI coding assistants will need to weigh the productivity gains these tools promise against the architectural challenges of preventing them from becoming vectors for credential theft and system compromise.