TORONTO, October 26, 2026 — The newest way to hijack an AI coding agent does not attack the model at all. It attacks the instructions the agent trusts. Research from Forever Security, published October 26, 2026, shows how a malicious AGENTS.md file turned AI coding agents into tools for installing malware and stealing credentials, by hiding hostile directions inside documents the agents treat as legitimate engineering guidance.

The investigation began when researchers found a suspicious AGENTS.md file in a customer's Downloads folder, after an agent's attempt to install the malicious npm package function-color was blocked before any code ran. The file looked like ordinary setup guidance. Instead, it told the agent to change its own configuration and prepare attacker-controlled tooling.

Forever reproduced the technique against OpenAI Codex. The malicious document posed as routine environment setup and instructed the agent to add a Model Context Protocol server entry to its global configuration file, then launch another Codex session with approval and sandbox protections bypassed. The configured command installed function-color. Because the change affected the user's global configuration, later Codex sessions could launch the attacker's command from other project folders. Forever reported success in more than 90% of its Codex tests. Checkmarx had previously linked function-color to the MALFEX npm campaign: the package acts as a wrapper for function-flag, whose malicious installation routine downloads and launches a Windows payload.

A separate demonstration against Claude Code used a crafted CLAUDE.md file that persuaded the agent to write an attacker-controlled API base URL into its settings file. API requests then reached the researchers' server, exposing an OAuth token that was successfully replayed against the legitimate service. Claude accepted the configuration change in roughly half of the tests.

"The agent supplies the permissions and the actions that make this dangerous," said Sarah Reid, Securetron spokesperson. "The text does not execute on its own. That is what makes file-based instruction attacks so hard to catch with endpoint tools: every step the agent takes looks like normal development work, until a token is gone or a payload is installed. If you cannot inspect and govern what your agents read, write, and send, you cannot see this attack coming."

The research carries an important caveat: Forever could not establish how the file reached the original customer's machine, and the website-delivery route was demonstrated during testing, not confirmed in that incident. The practical lesson stands either way. Developers should avoid starting coding agents in Downloads folders, inspect unfamiliar AGENTS.md and CLAUDE.md files before use, review agent configuration for unexpected MCP servers or API endpoints, and keep approval prompts and sandbox controls enabled.

AI-FW, Securetron's AI firewall and governance gateway, is built for exactly this gap: it sits between AI agents and the models they call, scanning every prompt and response in real time for jailbreaks, prompt injection, PII exposure, and data exfiltration, scoring requests against natural-language policies, and enforcing identity and access controls before traffic leaves the organization. Provider API keys stay server-side in the model registry, so endpoint agents never hold them, shrinking the blast radius if an agent is compromised. Every transaction lands in a metadata-only audit log, giving security teams full visibility without storing content, and the gateway fails closed by design. Its Community Edition is free to use, proprietary, and includes 10 billion tokens per month.

"Instruction files, tool outputs, pasted snippets, and web pages are all untrusted input to an agent," Reid added. "Teams already govern what their employees can send to a model. They need the same control over what their agents consume and what those agents are allowed to do with it. A gateway that inspects, governs, and audits agent traffic is that control."

About Securetron: Securetron builds enterprise security infrastructure: AI-FW, the self-hosted AI firewall and governance gateway between AI agents and LLM backends, and PKI Trust Manager with Boltron-AI for certificate lifecycle automation. For more information, visit https://securetron.net and https://aifw.io.

Press contact: Sarah Reid, Securetron, 1 Yonge St, Toronto, ON M5E 1E6, Canada, +1 (438) 927-8036, [email protected]