Traditional cybersecurity training has long framed executable binaries and manually invoked shell scripts as the primary threat vectors on end-user workstations. This foundational assumption is rapidly becoming obsolete with the widespread adoption of autonomous AI coding agents. Tools such as OpenAI Codex, Anthropic Claude Code, and Cursor automatically scan local directories for plain-text Markdown guides to align their behaviour with project conventions. Among these standard files, AGENTS.md has become a viable delivery vehicle for adversarial payloads, creating an attack path that demands re-evaluation of local file trust models.
This exploitation chain was first documented by the security research firm Forever Security, with independent validation from external researchers. The delivery mechanism is unusually passive. When a developer visits a malicious web page, the browser quietly saves a file named AGENTS.md into the user’s Downloads folder. No confirmation pop-up appears, and the user is not prompted to accept any download. The victim may never notice the file has landed on their system until they open a coding agent and point it at the Downloads directory. At that moment, the agent treats the Markdown document as authoritative project instruction and begins executing embedded directives without further explicit consent.
To a human reader, a malicious AGENTS.md is indistinguishable from ordinary engineering documentation at first glance. It can include coding style rules, interpreter version requirements, notes on dependency management, and other standard guidance that developers expect to see inside a project specification. For a coding agent equipped with terminal execution permissions, however, every embedded instruction inside this text translates directly into actionable system commands. The agent lacks a native mechanism to separate legitimate project guidance from carefully constructed adversarial prompts. The web page acts only as a delivery channel to drop the payload; the local AI agent becomes the execution engine that carries out the attacker’s instructions.
Forever Security reproduced the full attack chain inside controlled virtual environments to measure practical exploit success rates. For OpenAI Codex, the attack achieves a success rate above 90%. This high rate is not driven by short, obvious injection prompts that would immediately trigger safety filters. The researchers observed effective payloads of roughly 13 kilobytes. The vast majority of the document reads like a lengthy, credible internal project onboarding guide. Buried within this prose is a subtle section that tells Codex to register an external tools server, prepare runtime execution hooks, and spawn subprocesses with the flag -dangerously-bypass-approvals-and-sandbox.
Once the agent accepts these instructions, it voluntarily disables built-in approval workflows and sandbox protections, then proceeds to install malicious npm packages and modify persistent configuration. A particularly dangerous feature of this payload is its targeting of the global Codex configuration file located at ~/.codex/config.toml, rather than limiting changes to a single local project folder. After compromise, the altered configuration persists across all future development work. Even if a user later opens an entirely clean repository, Codex will retain the attacker-defined global rules and attempt to run the same compromised tooling pipeline.
Testing performed against Anthropic’s Claude Code returned a lower but still significant success rate close to 50%. The payload for this agent targets the file ~/.claude/settings.json. It rewrites the ANTHROPIC_BASE_URL value in both environment variables and project configuration entries, redirecting all outbound model requests to an attacker-controlled server. Visually, the modified URL can appear to be an internal corporate network address, so it frequently escapes casual manual inspection. Once the endpoint change takes effect, every API call originating from Claude Code routes through the hostile server. The attacker then responds with tool definitions marked dangerouslyDisableSandbox: true. This removes sandbox enforcement and grants the remote party the ability to send arbitrary Bash commands for execution on the developer’s host machine.
The end goals for these payloads are consistent across both agent platforms. Attackers seek to modify local environment settings, pull unvetted dependencies, harvest stored API tokens, intercept model traffic, and establish persistent access on developer workstations. Many developers store credentials for LLM providers and third-party services locally to streamline development workflows; an API gateway such as 4sapi can help teams centralise token distribution, enforce access boundaries, and log outbound API traffic to limit the damage if local secrets are exposed.
Security researchers have published a structured three-minute self-inspection workflow for developers running these coding agents on macOS or Linux systems. The audit covers four discrete areas, and each step relies on simple shell commands that can be run without additional tooling.
The first step scans for unfamiliar instruction files. Developers should search their Downloads folder, Desktop directory, and any newly cloned repositories for unknown AGENTS.md and CLAUDE.md files. Attackers have also used zero-width Unicode characters to obfuscate injected instructions. These invisible characters hide malicious prompt segments, so a file may look safe during visual review while containing instructions readable only by the AI agent. Any specification file pulled from an untrusted source requires full inspection before an agent is permitted to parse its content.
The second step validates the global Codex configuration. Auditors open ~/.codex/config.toml and look for unfamiliar MCP server definitions, unapproved shell command triggers, and references to unknown executable scripts. Any entry that the developer has not manually added should be treated as a sign of compromise.
Third, users audit installed npm packages. Package listing commands help identify recently installed dependencies, with special attention paid to packages linked to the known payloads from this campaign. If suspicious packages are discovered, the affected environment should be isolated, and dependency caches cleared to prevent repeated execution.
The final check targets Claude endpoint configuration. Developers verify the active ANTHROPIC_BASE_URL environment variable and the contents of every project-level claude/settings.json. If any endpoint address does not match a manually configured trusted service, the system is likely compromised. In such cases, all associated API tokens and active sessions must be rotated immediately. This inspection is not a one-time fix; it only reveals traces of this specific attack family and cannot defend against future variants.
It is important to recognise that model providers cannot fully patch this vulnerability with a single software update. The root cause lies in the core design choice of automatic local file ingestion combined with permission to run system commands. The malicious file is the input to the agent, much like a malicious web page feeds input to a browser. There is no discrete memory corruption bug or simple logic flaw to eliminate. Safety guardrails can reduce success rates, but well-crafted payloads embedded inside natural-looking documentation can still persuade agents to accept hostile instructions.
Practical defence therefore depends on consistent operational discipline. A core rule is to avoid launching coding agents directly inside the Downloads or Desktop folders. These locations are high-risk because browsers automatically deposit unvetted downloaded content here. All new files should be moved to dedicated, isolated working directories before an agent scans them. Developers should also audit instruction files from every external repository immediately after cloning, before allowing the coding agent to ingest the repository contents. Even repositories from seemingly reputable sources may receive pull requests containing injected AGENTS.md payloads.
Permission isolation forms another critical defensive layer. Developers should restrict agent subprocess access to directories holding SSH keys, environment files, and other sensitive secrets. Every agent session should follow the principle of least privilege, so that a compromised agent cannot reach high-value material unless explicitly granted access. Teams that regularly explore untrusted open-source projects should maintain separate sandbox environments for this work, isolated from workstations holding production credentials.
For thirty years, mainstream security guidance told users that they remained safe as long as they avoided running downloaded executables and unvetted shell scripts. That baseline no longer holds in the era of autonomous coding agents. Plain text has gained executable intent once an AI system is granted authority to act on its instructions. What once required convincing a victim to run an installer can now begin automatically, triggered only by visiting a web page and then opening an AI coding assistant. This moves security hygiene from a niche concern for security engineers into a mandatory practice for every developer using agentic tooling.
The threat will continue to evolve as coding agents gain richer native tooling capabilities. Broader access to system resources, package managers, and local file systems expands the scope of harm that a successful prompt injection can create. Attacks against coding agents are no longer limited to theoretical proof-of-concept demonstrations. This AGENTS.md trap is reproducible in live environments, as demonstrated by independent researcher Dremson, who streamed the complete execution sequence showing an agent reading the malicious Markdown and following its embedded instructions.
Model vendors will continue refining approval prompts, sandbox isolation, and input filtering. These controls add friction and lower exploit success rates, but they cannot fully eliminate the risk. The trust boundary between static documentation and executable instructions has blurred irreversibly for agentic coding assistants. Long-term resilience requires regular auditing routines, segmented working directories, careful credential management, and a fundamental shift in how developers judge the safety of ordinary text files. Even a harmless-looking Markdown document can become the trigger for a complete host compromise when paired with an autonomous agent that treats its content as orders.
