{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/credential-hijacking/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Codex","Claude Code"],"_cs_severities":["high"],"_cs_tags":["ai-security","prompt-injection","supply-chain","credential-hijacking","shadow-it"],"_cs_type":"advisory","_cs_vendors":["OpenAI","Anthropic"],"content_html":"\u003cp\u003eAI coding agents, such as OpenAI's Codex and Anthropic's Claude Code, are susceptible to an indirect prompt injection vector involving local markdown instruction files. When an agent is launched within a directory containing a malicious \u0026quot;AGENTS.md\u0026quot; file, the agent consumes the file as part of its project context and treats the contained text as trusted instructions. This allows an attacker to manipulate the agent's configuration, leading to unauthorized code execution, the installation of malicious packages (e.g., via NPM), or the exfiltration of sensitive credentials. As the agent's behavior is consistent with its intended design, there is no conventional software vulnerability to patch.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker places a malicious \u0026quot;AGENTS.md\u0026quot; file in a user-accessible directory, typically the Downloads folder (~/Downloads).\u003c/li\u003e\n\u003cli\u003eThe user navigates to the compromised directory using their terminal or IDE.\u003c/li\u003e\n\u003cli\u003eThe user launches an AI coding agent within the directory.\u003c/li\u003e\n\u003cli\u003eThe AI agent automatically parses the \u0026quot;AGENTS.md\u0026quot; file to interpret project-specific instructions or configuration.\u003c/li\u003e\n\u003cli\u003eThe AI agent executes malicious commands contained within the \u0026quot;AGENTS.md\u0026quot; file.\u003c/li\u003e\n\u003cli\u003eThe agent performs follow-on activities, such as modifying its local configuration, installing unauthorized packages, or accessing and exfiltrating login tokens.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary command execution within the agent's context. Observed impacts include unauthorized installation of NPM packages and potential theft of login tokens.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eTreat the user's Downloads directory (~/Downloads) as a hostile environment; strictly avoid running AI coding agents in this directory.\u003c/li\u003e\n\u003cli\u003eAudit active AI agent configurations for unexpected changes or unknown directives.\u003c/li\u003e\n\u003cli\u003eImplement and maintain approval gates for all actions taken by AI agents, including configuration modifications and package installations.\u003c/li\u003e\n\u003cli\u003eIf suspicious activity is detected, rotate all credentials and login tokens associated with the AI agent immediately.\u003c/li\u003e\n\u003cli\u003eEnable sandbox environments for all AI agent operations to limit access to sensitive directories and system resources.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T19:54:33Z","date_published":"2026-10-26T22:06:41Z","id":"https://feed.craftedsignal.io/briefs/2026-10-ai-agent-markdown-injection/","summary":"An indirect prompt injection technique exploits AI coding agents by planting malicious AGENTS.md files in user download directories to execute unauthorized commands or exfiltrate credentials.","title":"AI Coding Assistant: Indirect Prompt Injection via Local Markdown Files","url":"https://feed.craftedsignal.io/briefs/2026-10-ai-agent-markdown-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Credential-Hijacking","version":"https://jsonfeed.org/version/1.1"}