--- title: Malicious downloads can trick AI coding agents into... description: Malicious AGENTS.md and CLAUDE.md instruction files can trick AI coding agents, Forever Security found. A planted AGENTS.md in a customer's Downloads folder... canonical: https://daily.dev/posts/malicious-downloads-can-trick-ai-coding-agents-into-compromising-themselves-pvuaks4l2 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Malicious downloads can trick AI coding agents into compromising themselves | daily.dev og:description: Malicious AGENTS.md and CLAUDE.md instruction files can trick AI coding agents, Forever Security found. A planted AGENTS.md in a customer's Downloads folder... og:url: https://daily.dev/posts/malicious-downloads-can-trick-ai-coding-agents-into-compromising-themselves-pvuaks4l2 og:image: https://api.daily.dev/og/posts/PvUAKs4L2.png og:image:alt: Malicious downloads can trick AI coding agents into compromising themselves og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Malicious downloads can trick AI coding agents into compromising themselves **[CSO Online](https://daily.dev/sources/csoonline)** · 5 min read · 0 upvotes · 0 comments ## Summary Malicious AGENTS.md and CLAUDE.md instruction files can trick AI coding agents, Forever Security found. A planted AGENTS.md in a customer's Downloads folder told Codex to install a malicious npm package called function-color, which was blocked before execution. In follow-up tests, Codex followed malicious instructions in more than 90% of cases, including modifying its machine-wide MCP configuration and launching a session with approval and sandbox restrictions bypassed. A similar CLAUDE.md attack against Claude Code redirected API traffic to a researcher-controlled server in about half of the tests, and a captured OAuth token was successfully replayed against the real API. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can a malicious AGENTS.md file in my Downloads folder attack OpenAI Codex? A planted AGENTS.md file can instruct Codex to install malicious npm packages, modify its machine-wide MCP server configuration, and launch sessions with approval and sandbox restrictions bypassed. Forever Security found Codex followed such malicious instructions in more than 90% of tests. Because the rogue MCP server gets registered machine-wide, it can persist and load again even after the developer switches to a different project directory. _Developers hardening Codex workflows can track emerging agent exploits like this one on daily.dev._ ### Can a CLAUDE.md file be used to steal Claude Code's API credentials? Yes, a malicious CLAUDE.md file can redirect Claude Code's API traffic to an attacker-controlled server, exposing authentication tokens and letting that server supply commands for the agent to execute. Forever Security's tests succeeded in roughly half of attempts, and researchers also successfully replayed a captured OAuth token against the legitimate API to demonstrate account takeover. _Teams securing Claude Code deployments can follow coverage of agent credential risks on daily.dev._ ### How can I protect AI coding agents from malicious instruction file attacks? Treat agent instruction files like source code with designated owners reviewing changes, keep sandboxes enabled, restrict network access, and route installs through internal package registries or scanning proxies, Kanerika's Amit Kumar Jena recommends. Omdia's Jonathan Ong also advises disabling flags like '--dangerously-bypass-approvals-and-sandbox' and adding human oversight for suspicious agent behavior. _Engineers setting agent security policy can keep up with these hardening recommendations on daily.dev._ ## Similar posts on daily.dev - [Mozilla Shows the Danger of Indirect Prompt Injections in AI Coding Agents](https://daily.dev/posts/mozilla-shows-the-danger-of-indirect-prompt-injections-in-ai-coding-agents-nqhoyxkhl) · DevOps.com · 0 upvotes · 0 comments - [Your CLAUDE.md File Is Now a Malware Delivery Mechanism](https://daily.dev/posts/your-claude-md-file-is-now-a-malware-delivery-mechanism-1cm6dlqyv) · Medium · 1 upvotes · 0 comments - [Supply-chain attacks take aim at your AI coding agents](https://daily.dev/posts/supply-chain-attacks-take-aim-at-your-ai-coding-agents-o8vsjrfrt) · CSO Online · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#claude-code](https://daily.dev/tags/claude-code), [#prompt-injection](https://daily.dev/tags/prompt-injection), [#openai-codex](https://daily.dev/tags/openai-codex) [View this post on daily.dev](https://daily.dev/posts/malicious-downloads-can-trick-ai-coding-agents-into-compromising-themselves-pvuaks4l2) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious downloads can trick AI coding agents into compromising themselves","url":"https://daily.dev/posts/malicious-downloads-can-trick-ai-coding-agents-into-compromising-themselves-pvuaks4l2","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/malicious-downloads-can-trick-ai-coding-agents-into-compromising-themselves-pvuaks4l2"},"datePublished":"2026-10-26T10:37:47.627Z","dateModified":"2026-10-26T11:19:08.857Z","description":"Malicious AGENTS.md and CLAUDE.md instruction files can trick AI coding agents, Forever Security found. A planted AGENTS.md in a customer's Downloads folder...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f1620a08819dc24147608a0fa7ec4603?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f1620a08819dc24147608a0fa7ec4603?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/malicious-downloads-can-trick-ai-coding-agents-into-compromising-themselves-pvuaks4l2","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents,claude-code,prompt-injection,openai-codex","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"Malicious downloads can trick AI coding agents into compromising themselves"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/malicious-downloads-can-trick-ai-coding-agents-into-compromising-themselves-pvuaks4l2#faq","mainEntity":[{"@type":"Question","name":"How can a malicious AGENTS.md file in my Downloads folder attack OpenAI Codex?","acceptedAnswer":{"@type":"Answer","text":"A planted AGENTS.md file can instruct Codex to install malicious npm packages, modify its machine-wide MCP server configuration, and launch sessions with approval and sandbox restrictions bypassed. Forever Security found Codex followed such malicious instructions in more than 90% of tests. Because the rogue MCP server gets registered machine-wide, it can persist and load again even after the developer switches to a different project directory. Developers hardening Codex workflows can track emerging agent exploits like this one on daily.dev."}},{"@type":"Question","name":"Can a CLAUDE.md file be used to steal Claude Code's API credentials?","acceptedAnswer":{"@type":"Answer","text":"Yes, a malicious CLAUDE.md file can redirect Claude Code's API traffic to an attacker-controlled server, exposing authentication tokens and letting that server supply commands for the agent to execute. Forever Security's tests succeeded in roughly half of attempts, and researchers also successfully replayed a captured OAuth token against the legitimate API to demonstrate account takeover. Teams securing Claude Code deployments can follow coverage of agent credential risks on daily.dev."}},{"@type":"Question","name":"How can I protect AI coding agents from malicious instruction file attacks?","acceptedAnswer":{"@type":"Answer","text":"Treat agent instruction files like source code with designated owners reviewing changes, keep sandboxes enabled, restrict network access, and route installs through internal package registries or scanning proxies, Kanerika's Amit Kumar Jena recommends. Omdia's Jonathan Ong also advises disabling flags like '--dangerously-bypass-approvals-and-sandbox' and adding human oversight for suspicious agent behavior. Engineers setting agent security policy can keep up with these hardening recommendations on daily.dev."}}]} ```