Researchers have intercepted an attack that used a local instruction file to attempt malware installation, raising questions about where organizations allow employees to run AI coding agents.
In a report published on Oct. 22, Forever Security described finding a malicious AGENTS.md file in a customer’s Downloads folder. Disguised as ordinary project guidance, the file instructed a coding agent to change its configuration and install a malicious npm package.
The agent could be manipulated into carrying out the instructions included in the file using its existing permissions, although the company blocked the attempt before code was executed.
The researchers reproduced the attack against OpenAI Codex and demonstrated a related attack against Claude Code using a malicious CLAUDE.md file.
“There is nothing here for OpenAI or Anthropic to patch,” they wrote. “An agent that follows the AGENTS.md in its folder is doing exactly what it was built to do.”
In an online guide, OpenAI explains that Codex reads AGENTS.md files before starting work, combining global guidance with project instructions. Instructions closer to the working directory take precedence over earlier project guidance. Without a project root, Codex checks only the current directory for project instructions.
This process creates risks that may require organizations to make decisions beyond approving an AI tool itself, such as deciding which locations can supply instructions and who can place files in those locations.
Defining where agents can operate
According to Forever Security, the attack they identified abuses intended agent behavior, making workspace policies central to managing the risk.
The researchers recommend keeping agents out of Downloads folders, reviewing unfamiliar instruction files, and checking configurations for unexpected changes, while retaining approval gates and sandboxes.
Their “nothing to patch” assessment concerns attacks exploiting normal instruction handling. It does not establish that vendors cannot strengthen safeguards against these attacks or that workspace restrictions alone can prevent them.
Forever Security could not determine how the malicious file had reached its customer’s device. The researchers separately demonstrated that a website could initiate the file’s download into the Downloads folder.
