A security researcher dropped a single markdown file into a Downloads folder and watched a production AI coding agent install malware on command.
TL;DR
AGENTS.md prompt injection succeeds because coding agents treat instruction files as trusted operator configuration rather than untrusted input. Attackers exploit this by planting malicious directives in files the agent reads automatically from its working directory. A single AGENTS.md placed in ~/Downloads caused Codex to install a harmful npm package; a planted CLAUDE.md caused Claude Code to leak OAuth tokens. Location determines trust: files read at the system-prompt layer carry authority that overrides user intent. Restricting which directories agents scan and sandboxing file-class permissions are the most effective defenses available today.
Key Takeaways
- File location determines agent trust: Instruction files like AGENTS.md enter at the system-prompt layer, where they can override user instructions before any guardrail fires.
- AGENTS.md can trigger malicious installs: A planted AGENTS.md in ~/Downloads caused Codex to install a harmful npm package, per the Cloudanix researcher disclosure.
- CLAUDE.md can expose OAuth tokens: A planted CLAUDE.md redirected Claude Code's API traffic, leaking credentials, per the same disclosure.
- Injections escalate across pipelines: One compromised agent can pass malicious instructions downstream to agents with broader permissions, amplifying damage considerably.
- Apply controls now: Working-directory restrictions, file-class allowlists, integrity verification, and least-privilege sandboxing address the exposure without waiting for a vendor patch.
Introduction
AI coding agents (Codex, Claude Code, and similar tools) treat certain working-directory files as authoritative system instructions by convention, not by any formal policy. Research showed a malicious AGENTS.md in ~/Downloads can make Codex install malware or leak tokens. That is a control-plane failure. Model guardrails do not catch it because the attack changes what the agent is authorized to do before any filter fires.
Why Does File Location Give AGENTS.md Higher Authority Than Your Own Instructions?
File location grants AGENTS.md higher authority because agents read instruction files at the system-prompt layer before processing the user's task, giving those files the same trust tier as operator configuration. On startup, agents read files like AGENTS.md and CLAUDE.md before they ever touch the user's task prompt. Those files land at the system-prompt layer, the same authority tier as the original operator configuration, so the user's instruction competes from a lower tier and often loses.
This implicit file-trust hierarchy is an inherited assumption, not a deliberate design decision. The injection succeeds before any guardrail fires, which makes it structurally different from chatbot attacks.
How Do the AGENTS.md and CLAUDE.md Attacks Actually Work?
AGENTS.md to Codex malicious install: An attacker plants an AGENTS.md in ~/Downloads that tells the agent to run a specific npm install command. Because the file enters context at the system-prompt layer, Codex runs the install without flagging it as suspicious.
CLAUDE.md to OAuth token exfiltration: A planted CLAUDE.md tells Claude Code to route API traffic through an attacker-controlled proxy, exposing the agent's OAuth token, per the same disclosure.
What separates this from direct prompt injection is the delivery method. The attack surface is filesystem write access, not model reasoning. Planting a file requires only write access to the working directory, which a build script, an unzipped archive, or an npm postinstall hook could provide in a compromised or misconfigured environment.
Does File Type Change How Often an Agent Obeys a Malicious Instruction?
The File-Class Trust Gradient
| File class | Semantic role | Estimated compliance | Attack utility |
|---|---|---|---|
| AGENTS.md / CLAUDE.md | Operator configuration | Highest | Primary vector |
| README / TODO | Contributor instructions | Elevated | Secondary vector |
| Source code (.js, .py) | Artifact to process | Low | Poor vector |
| Raw data (.csv, .json) | Artifact to analyze | Lowest | Minimal utility |
Relative compliance estimates reflect author assessment; independent empirical replication is needed. This table represents the author's synthesis and should not be read as externally measured data.
That means allowlisting must cover the entire instruction-like file category, not just AGENTS.md specifically.
What Controls Can Organizations Apply Right Now?
Control 1, Working-directory restrictions: Agents should only operate inside designated, access-controlled project directories. Never point Codex or Claude Code at ~/Downloads, /tmp, or any shared staging area. Treat working-directory scope as a formal policy decision, the same way you would treat network egress rules.
Control 2, File-class allowlists: Define which file types agents may treat as instruction sources. Any AGENTS.md appearing outside an approved repository path should be rejected outright, applying the same logic you would use to block unsigned .npmrc overrides in a supply-chain policy.
Control 3, Instruction-file integrity verification: Hash and sign known-good AGENTS.md and CLAUDE.md at commit time. An unrecognized or unsigned file should halt execution rather than proceed quietly.
Control 4, Least-privilege sandboxing: Run agents in isolated containers with no network egress beyond necessary endpoints and no write access outside the project directory. In multi-agent pipelines, a compromised agent passes poisoned output to a downstream agent with broader permissions, amplifying the damage considerably. Sandboxing is not optional in that context.
Frequently Asked Questions
What makes ~/Downloads a particularly dangerous working directory? ~/Downloads receives files from untrusted external sources by design, making a planted AGENTS.md indistinguishable from legitimate project configuration. The file is read with full system-prompt authority and no provenance check, which is exactly what the attack requires.
Does AGENTS.md injection bypass model-level safety guardrails? Yes. Injected content enters at the system-prompt layer before model-level filters evaluate user-turn input, so the model receives it as operator configuration rather than as a threat to be screened.
How does multi-agent privilege escalation amplify a single injection? A poisoned instruction propagates through the pipeline. The downstream agent treats the first agent's output as trusted input and executes actions the attacker could not trigger directly, turning a single planted file into a multi-stage attack.
How is AGENTS.md similar to supply-chain attacks on .npmrc or Makefile? AGENTS.md, .npmrc, and Makefile are all trusted build-process files in predictable locations that privileged tooling reads automatically, making them equivalent targets for supply-chain-style file-planting attacks. Signing, path pinning, and integrity verification apply directly to all three.
Conclusion
Most organizations have considered LLM output filtering carefully and given far less thought to which directories their agents can read. The implicit file-trust hierarchy was never designed; it was inherited. Until it is replaced by explicit, verifiable policy, any process that can write a file to an agent's working directory is effectively a system-prompt author.
Signed instruction files, path-pinned configuration, and scoped working directories are the framework used in this guide for addressing the exposure. None require waiting for a vendor fix.
Your next step: Audit every AI coding agent deployment this week. Document each agent's working directory, identify which file types it treats as instruction sources, and apply restrictions before your next sprint, starting with any agent ever pointed at ~/Downloads.
Learn from me
Forward Deployed Engineering Bootcamp for Full-Stack Developers, my Maven cohort. Build and ship complete AI products end to end, from React and Node.js frontends to deployed models with caching and observability. Join the next cohort →
Hire us
Traversaal.ai. We're a team of forward deployed engineers solving the toughest AI problems for Fortune 100 companies: document intelligence, agentic data platforms, and real-time web intelligence, deployed in production. Work with our team to deploy your next agentic ecosystem. Talk to Traversaal.ai →
Join us
Want to solve these problems with us? We're always looking for forward deployed engineers who want to ship production AI. jobs@traversaal.ai
