AI Coding Agent Security: How a Hidden AGENTS.md File Can Hijack Your Agent

AI coding agents read instruction files to understand a project. AGENTS.md tells Codex and other agents how a repository works; CLAUDE.md does the same for Claude Code. That convenience has a dark side, and in October 2026 security researchers showed exactly how dangerous it can be.

According to research by Forever Security, reported by Help Net Security on 26 October 2026, a malicious instruction file silently dropped into a developer’s Downloads folder was enough to make AI coding agents install malware and leak login tokens. Here is what happened, why it matters for every team using AI in development, and the practical steps we recommend.

What the researchers found

Forever Security researchers Gal Weizman and Omer Samet reported that they found a malicious AGENTS.md file on a customer’s computer, where their software blocked it. They then tested how coding agents react to files like it.

According to the report:

  • OpenAI Codex trusted the planted AGENTS.md, changed its own settings and installed a malicious npm package (function-color, since removed from npm). In the researchers’ tests, Codex ran the malware in more than 90% of attempts.
  • Claude Code was harder to fool, but a planted CLAUDE.md still convinced it to save a settings change that routed its requests through an attacker-controlled server in about 50% of attempts. The researchers say they could then replay a captured login token and access the account.
  • No vendor patch was announced. The researchers argued there is “nothing here for OpenAI or Anthropic to patch”, because the agents behaved as designed: they followed the instructions in the folder they were started in.

How the attack works

The attack chain is simple, which is what makes it worrying:

  1. A web page drops a file. Visiting a malicious site can save an AGENTS.md or CLAUDE.md file into the Downloads folder, with no click needed.
  2. A developer starts an agent in Downloads. Many people unzip a project or a script there and open their agent in the same folder.
  3. The agent trusts the file. It treats the instructions as project context, just like a real AGENTS.md.
  4. The attacker’s instructions run. Install a package, change a setting, send traffic to another server.
  5. The damage outlives the session. The report notes that Codex’s settings changes apply to the whole computer, so later sessions in other projects are affected too, and a stolen token works like a live login.

This is a form of prompt injection: hidden text that an AI reads and obeys as if it came from the user. The new twist is that the payload is a file agents are designed to trust.

Why this matters for businesses

You might think this is only a problem for big tech companies. It is not. Any business whose developers, agencies or freelancers use AI coding agents is exposed, because:

  • agents run with the developer’s permissions: files, credentials, SSH keys, cloud logins;
  • one compromised laptop can expose client code, databases and production servers;
  • a stolen AI account token can leak your code and conversations, and run up costs.

AI agents are worth using. We use them every day at Sabright, as we describe in How Sabright Uses AI Coding Agents to Build Software Faster. But they must be treated like any powerful tool with access to your systems.

The 10-point checklist we recommend

Where agents run

  1. Never start a coding agent in Downloads, Desktop or your home folder. Start it only inside a specific project folder you trust.
  2. Read every AGENTS.md and CLAUDE.md you did not write, including in repositories you have just cloned or downloaded. If an instruction file asks to change settings, install packages or contact a server, stop.
  3. Use separate environments for unknown code, such as a container, a virtual machine or a cloud sandbox, never your main laptop with all your credentials.

What agents are allowed to do

  1. Keep approval prompts and sandboxes switched on. Treat any instruction to disable them, from a file, a web page or a “helpful” tip, as an attack.
  2. Allowlist commands instead of allowing everything. Running tests and linters automatically is fine; installing packages, changing configuration or reaching the network should need approval.
  3. Use least-privilege credentials. Agents should never see production database passwords, payment keys or admin tokens. Use scoped, short-lived tokens for things like GitHub and Jira.

Watching for trouble

  1. Check agent settings files regularly for servers, proxies or addresses you did not add.
  2. Lock down package installs. Use lockfiles, review new dependencies in pull requests, and consider tools that flag malicious packages.
  3. Restrict outbound network access from build machines and sandboxes to the services they actually need.
  4. Have a response plan. If you find a planted instruction file, the researchers advise assuming your login token has leaked: revoke and replace it, and treat any machine where function-color was installed as compromised.

How we apply this at Sabright

These rules are part of our standard development workflow:

  • agents only run inside project repositories, on branches, never against live systems;
  • every repository’s instruction file is written and reviewed by our team, and changes to it go through pull requests like any other code;
  • secrets are kept out of repositories and out of agent reach;
  • risky actions (installs, deployments, deletions, network changes) require human approval;
  • every change is reviewed by a second agent and a human engineer before it merges, with automated tests in GitHub Actions.

The result is the speed of AI-assisted development without handing the keys of your business to a text file.

The bigger lesson

AI agents follow instructions, and they cannot always tell who wrote them. As agents get more powerful, with browsing, tool access through MCP and long-running tasks, every source they read (web pages, emails, documents, instruction files) becomes a possible way in.

The answer is not to stop using agents. It is to give them clear boundaries: trusted folders, minimal permissions, approval for risky actions and humans who review the result. Teams that build these habits now will be able to use AI safely as it becomes a bigger part of software development.

Need a safe AI development setup?

Sabright helps businesses adopt AI coding agents, automation and AI integrations with security built in, from sandboxed environments and permission policies to reviewed workflows in GitHub. Whether you want us to build your next custom software project with AI-accelerated workflows, or to set up a secure agent workflow for your own team, talk to us.

Sources

← Back to Blog