How malicious files trick AI coding agents into malware

Cybersecurity researchers have uncovered a new attack vector. The threat targets software developers who use automated artificial intelligence coding assistants. Attackers plant malicious instruction files quietly inside local user directories. These hidden files successfully manipulate autonomous AI agents into executing harmful commands and installing unauthorized software packages.

How the Exploit Works Inside Local Workspaces

A recent threat report from security firm Forever Security detailed the technique. The exploit takes advantage of a fundamental design feature built into modern coding tools. AI agents like OpenAI’s Codex and Anthropic’s Claude Code are designed to read plain-text direction files automatically. These instruction documents, often named AGENTS.md or CLAUDE.md, are executed whenever an agent initializes inside a workspace folder.

The security researchers explained how they intercepted the threat in a live environment:

Forever stopped a coding agent, mid-session, from installing function-color. That software is a known malicious npm package. The package originated from a threat campaign that flew under the radar for roughly two years until researchers caught and documented it publicly. Blocking a known-bad package is routine security work, so the incident response team investigated further. One detail stood out immediately: the origin of the installation order.

The command did not come from an ordinary dependency tree. It did not come from a standard code repository. It originated inside the customer’s local Downloads folder. Investigators traced the data trail backward. The coding agent had not gone looking for malware independently. It was simply following an AGENTS.md instruction file left inside that directory—the exact type of file that Codex reads upon startup and obeys without question.

Browser Silent Downloads and Directory Risks

Modern web browsers can silently save downloaded files directly onto a user’s hard drive. This happens without triggering active permission prompts. Consequently, malicious actors can drop hostile instruction files into common directories that coding agents implicitly trust.

Testing Results Across Leading AI Models

During controlled testing, researchers evaluated how different AI assistants handled the threat. When OpenAI’s Codex was initialized inside a compromised workspace folder, it followed the hidden directives over ninety percent of the time. The planted instructions tricked the agent into registering an unauthorized remote server inside global configuration files. It also forced the agent to install malicious npm packages silently.

Against Anthropic’s Claude Code, the attack achieved a lower success rate. Built-in human approval prompts frequently flagged suspicious system modifications. However, the attack still bypassed security defenses in roughly half of the experimental trials.

Design Features Versus Software Bugs

Industry experts emphasize that this vulnerability does not stem from a software bug in products created by OpenAI or Anthropic. Instead, the risk arises from agents operating exactly as designed. The software simply trusts instructions found within local workspace environments. Furthermore, telemetry data indicates that a significant percentage of software developers frequently launch coding agents directly out of their Downloads directories while simultaneously browsing the open internet.

Practical Mitigation Strategies for Developers

To mitigate this emerging risk, security professionals recommend several practical precautions. Developers should avoid launching coding agents inside default download directories. Teams should routinely inspect local configuration files for unauthorized server additions or modified base URLs. Furthermore, engineers must carefully review any unfamiliar Markdown instruction files before letting automated tools execute commands within a project repository.

Broader Implications for Supply Chain Security

The broader security implications extend beyond individual developer workstations. As AI coding tools gain popularity, enterprise security teams must adapt their threat models to monitor autonomous agent behavior. Malicious actors are shifting away from traditional malware delivery mechanisms. Instead, they exploit the collaborative workflows that make modern AI assistants appealing to developers.

Additional threat research highlights that similar prompt injection vectors can affect local terminal environments. When AI agents interface directly with shell commands, any untrusted text file present in the working directory becomes a potential attack surface. Malicious actors can obfuscate instructions inside seemingly harmless documentation, README files, or image metadata. When an agent parses these files during a routine repository scan, it can inadvertently execute malicious scripts.

Securing the software supply chain now requires scrutinizing local documentation files just as rigorously as third-party code libraries. Developers must maintain strict hygiene across all local directories. Keeping workspace environments clean of unverified text files prevents autonomous agents from misinterpreting foreign directives.

Final Warning From Security Researchers

Forever Security concluded their public report with a stark warning:

We caught this one because we were watching the agent, rather than the user. The next attack will not look like this one—and anyone still watching only the user will miss it too.

As artificial intelligence integration deepens across software development pipelines, safeguarding local execution environments remains an essential priority. Maintaining endpoint security protects sensitive API credentials, production infrastructure, and proprietary source code against sophisticated supply chain threats today.

How These Dangerous Files Are Tricking AI Agents Into Installing Malware