Malicious Downloads Can Hijack AI Coding Agents and Steal Tokens
The attack exploits instruction files that AI coding tools use to understand project requirements. OpenAI Codex supports AGENTS.md, while Claude Code can read CLAUDE.md. These plain-text files typically contain legitimate guidance about coding standards, project setup and development workflows. However, an attacker can disguise harmful instructions as ordinary engineering documentation. When an…
Malicious downloads can compromise AI coding agents by tricking them into following harmful instructions disguised as regular project documentation. OpenAI Codex and Claude Code, two popular AI coding assistants, are vulnerable to this attack. Attackers can create malicious Markdown files, such as AGENTS.md for Codex or CLAUDE.md for Claude, that contain instructions designed to manipulate the agent into performing dangerous actions.
In one demonstration, a malicious AGENTS.md file instructed the Codex agent to install a suspicious npm package. Although the security system blocked the installation attempt, the attack shows the potential for AI agents to execute unauthorized commands when given malicious instructions. A similar attack targeted Claude Code, where a malicious CLAUDE.md file redirected the agent's API traffic to a server under the attacker's control.
This could allow the server to steal authentication tokens and return instructions that the agent might execute.
The attack is different from traditional malware that relies on executable files or software vulnerabilities. Instead, it exploits the instructions an AI agent is designed to follow, which do not need to contain executable code. This makes it harder to detect and protect against. Developers can reduce the risk by avoiding running AI agents from the Downloads folder, reviewing unfamiliar instruction files, enabling security controls, checking for unauthorized configuration changes, restricting package installations, and protecting authentication tokens.
If a suspicious instruction file is discovered, developers should investigate whether the agent executed any commands or changed its configuration.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
