Cybersecurity firm Forever Security has intercepted live malware utilizing a novel indirect prompt injection technique targeting AI coding assistants like OpenAI’s Codex and Claude Code. The attack relies on planting malicious markdown instruction files (such as “AGENTS.md”) into a user’s local downloads directory, disguised as harmless engineering notes. When developers launch autonomous coding agents within the affected directory, the agent ingests the file as part of its project context and executes unauthorized configuration rewrites. Researchers note that because the agents are functioning exactly as designed by reading local instruction files, traditional software patches from AI labs cannot resolve the vector. Industry experts advise treating user download folders as hostile environments for AI workflows, maintaining rigorous sandbox restrictions, and routinely auditing agent configurations and credentials.

Full report : Newly documented attacks leverage malicious local instruction files dropped into download directories to hijack autonomous development assistants.