Researchers report instruction-file attacks on coding agents
Forever Security says hostile files can steer agents launched in Downloads, with separate tests opening a calculator and exposing a test agent’s access token.
Loading… Բեռնվում է…
Forever Security says hostile files can steer agents launched in Downloads, with separate tests opening a calculator and exposing a test agent’s access token.
Forever Security says a hostile instruction file in a customer’s Downloads folder tried to make a superintelligence (SI) coding agent install the malicious software package function-color, but the company stopped the attempt before any code ran. In separate tests described by The Hacker News on 26 October, the company said Codex ran malware in more than 90% of attempts and a Claude Code configuration write was approved about half the time.
BleepingComputer’s 25 October account described how the customer’s Downloads folder also served as the agent’s working directory—the location it used as its starting project context. Coding agents automatically read applicable instruction files there to learn project rules, such as how to run tests or which tools to use.
The customer’s file was called AGENTS.md. Such plain-text files are not executable programs, but an agent following hostile instructions can run commands, install software or change settings through its own tools and permissions. Forever Security could not determine how the file reached the customer’s Downloads folder; delivery through a webpage was not established for that incident.
The 26 October account described a Codex test using the real attacker’s instruction file inside an isolated virtual machine—a separate software environment. The file presented its directions as routine project setup and told Codex to register a server in its global configuration and install the malicious package. Because that configuration applies across sessions, the company said the change would load the attacker’s server even when Codex later started in another folder.
For Claude Code, a planted CLAUDE.md file presented as internal engineering documentation sought to change a project setting so requests to the model went to a researcher-controlled server. The researchers said Claude Code requires a person to approve that write and often refuses suspicious changes. Their roughly one-in-two figure in the 26 October account measured approval of the configuration write, not code execution.
The W27 keeps the Galaxy Z Fold 8 Ultra’s core hardware, with dark-red or dark-blue finishes, golden accents and 16GB of working memory in both storage versions.
2 min
| Account date | Agent | Test and measured outcome | Reported rate |
|---|---|---|---|
| 26 October | Codex | Real attacker file in an isolated virtual machine; malware execution. | More than 90% |
| 26 October | Claude Code | Instruction file framed as engineering documentation; approval of a configuration write redirecting model requests. | About half the time |
| 25 October | Codex | Reconstructed attack with a harmless payload; opening the calculator app. | 90% |
| 25 October | Claude Code | Hostile instruction file exposed an access token; code execution through commands returned by the researchers’ server. | Roughly 50% |
Redirecting Claude Code’s model requests exposed an OAuth token, a credential used to authorise account access. The researchers’ server could then impersonate the model and return requests for the agent’s tools to execute code. That token exposure occurred in a test, not the blocked customer incident. The trial counts behind the reported percentages have not been disclosed.
The described Downloads attack requires the user to launch the coding agent in that same folder so it reads the hostile instruction file. Merely downloading the file is not the demonstrated command-execution step.
BleepingComputer tested the researchers’ demonstration webpage and saw it download an AGENTS.md file containing harmless text. This demonstrated a possible delivery route, not the route used against the customer.
Chrome, Edge and Firefox commonly save files to Downloads without asking the user to choose a location, but all three display download notifications by default. In BleepingComputer’s Brave browser test, the browser requested approval before downloading. A download without a save-location prompt is therefore not necessarily invisible.
OpenAI and Anthropic recommend starting coding agents in the root folder of the specific project they should work on, rather than Downloads, the home folder or a broad parent folder. This reduces exposure to unrelated, untrusted instruction files. Depending on the tool, the working directory also helps establish which files the agent can access; it is not a universal access barrier.
Users should review unfamiliar AGENTS.md, CLAUDE.md or similar files before allowing an agent to follow them. Keep approval prompts and sandbox protections—controls that restrict what the agent can do—enabled, and test untrusted code in an isolated environment before running it on the main system. Expand the agent’s access only when the task requires it.
Forever Security also advises checking agents’ configuration files for unfamiliar servers or changed destinations for model requests. If users find a planted instruction file, the company advises treating the login token as exposed and replacing it.
The satellite operator expects access to more than twice OneWeb’s current bandwidth in return for spending in 2027–2034, with initial IRIS² services expected from 2030.
3 min
The black, gold and green edition follows September’s sold-out preorders. Nintendo’s replenished launch-day stock also quickly sold out.
1 min