AI Coding Assistant: Indirect Prompt Injection via Local Markdown Files

AI coding agents, such as OpenAI's Codex and Anthropic's Claude Code, are susceptible to an indirect prompt injection vector involving local markdown instruction files. When an agent is launched within a directory containing a malicious "AGENTS.md" file, the agent consumes the file as part of its project context and treats the contained text as trusted instructions. This allows an attacker to manipulate the agent's configuration, leading to unauthorized code execution, the installation of malicious packages (e.g., via NPM), or the exfiltration of sensitive credentials. As the agent's behavior is consistent with its intended design, there is no conventional software vulnerability to patch.

Attack Chain

1. An attacker places a malicious "AGENTS.md" file in a user-accessible directory, typically the Downloads folder (~/Downloads).
2. The user navigates to the compromised directory using their terminal or IDE.
3. The user launches an AI coding agent within the directory.
4. The AI agent automatically parses the "AGENTS.md" file to interpret project-specific instructions or configuration.
5. The AI agent executes malicious commands contained within the "AGENTS.md" file.
6. The agent performs follow-on activities, such as modifying its local configuration, installing unauthorized packages, or accessing and exfiltrating login tokens.

Impact

Successful exploitation allows for arbitrary command execution within the agent's context. Observed impacts include unauthorized installation of NPM packages and potential theft of login tokens.

Recommendation

• Treat the user's Downloads directory (~/Downloads) as a hostile environment; strictly avoid running AI coding agents in this directory.
• Audit active AI agent configurations for unexpected changes or unknown directives.
• Implement and maintain approval gates for all actions taken by AI agents, including configuration modifications and package installations.
• If suspicious activity is detected, rotate all credentials and login tokens associated with the AI agent immediately.
• Enable sandbox environments for all AI agent operations to limit access to sensitive directories and system resources.