AI Agent Instruction File Hijacking

AI Agent Instruction File Hijacking occurs when attacker-controlled instructions are placed inside files that AI coding agents automatically discover and trust, such as AGENTS.md, CLAUDE.md, or similar workspace configuration files. When the agent enters the affected directory, the malicious instructions can influence tool use, modify agent configuration, install software, redirect API traffic, expose authentication tokens, or execute attacker-controlled commands.

AI coding agents increasingly rely on local instruction files to understand how they should operate inside development environments.

Files such as:

AGENTS.md
CLAUDE.md
Repository instruction files
Agent configuration files
Workspace-specific operating instructions

may be automatically loaded and incorporated into an agent’s working context.

This creates a new trust boundary.

An attacker does not necessarily need to exploit the underlying AI model or application. Instead, they can place malicious instructions somewhere the agent is designed to trust.

Once processed, those instructions may cause the agent to use its legitimate capabilities against the system it is operating on.

In October 2026, Forever Security disclosed a real customer incident involving a malicious AGENTS.md file located in a Downloads directory. The instructions caused an AI coding agent to attempt installation of a known malicious npm package. The activity was blocked before the malware executed. Researchers subsequently reproduced related attacks against OpenAI Codex and Claude Code, demonstrating command execution, configuration manipulation, and credential exposure. Forever

The important security distinction is that the instruction file itself is not traditional executable malware.

The AI agent becomes the execution mechanism.

AI coding assistants commonly search their current directory and repository hierarchy for files containing project-specific instructions.

These files may tell the agent:

• Which tools to use
• How to build an application
• Which commands to execute
• How testing should be performed
• What services should be contacted
• Which configuration settings should be applied

An attacker who controls one of these files can transform legitimate agent behavior into an execution path.

The malicious instructions may be delivered through:

Downloaded files
Cloned repositories
Compromised repositories
Malicious pull requests
Extracted archives
Shared development folders
Generated project templates
Third-party source packages

When the AI agent enters the affected workspace, it reads the attacker-controlled instructions as operational context.

No traditional executable file needs to be opened by the user.

1. Attacker Creates Trusted-Looking Instruction File
The attacker prepares an AGENTS.md, CLAUDE.md, or comparable agent instruction file containing malicious directives.

2. File Enters the Developer Environment
The instruction file arrives through a download, repository, archive, shared project, or other content source.

3. Agent Enters the Affected Directory
The developer or automation system launches an AI coding agent inside the location containing the file.

4. Agent Automatically Loads Instructions
The AI system interprets the malicious content as legitimate workspace guidance.

5. Agent Selects Connected Tools
The instructions influence shell commands, package managers, configuration tools, browsers, APIs, or other connected capabilities.

6. Unauthorized Action Occurs
The agent may:

Install a package
Execute commands
Modify configuration
Redirect API traffic
Change tool endpoints
Access credentials
Download additional payloads

7. Persistence or Credential Theft May Follow
Changes to global configuration, authentication tokens, or tooling may continue affecting future agent sessions.

8. Agent Becomes the Attack Execution Layer
The malicious file itself may never execute. Instead, the trusted AI agent interprets and operationalizes the attacker’s instructions.

AI coding assistants
Autonomous development agents
OpenAI Codex-style agents
Claude Code-style agents
CLI-based AI development tools
Repository-aware AI assistants
Agentic IDE extensions
MCP-enabled coding agents
Development workstations
Source-code repositories
Package-management environments
CI/CD development workflows
Agent configuration stores

AI instruction-file hijacking transforms trusted enterprise development tooling into an attacker-controlled execution path.

Potential consequences include:

Endpoint compromise
Malware installation
Developer credential theft
Source-code exposure
Cloud credential compromise
AI provider token theft
Unauthorized MCP configuration
Persistent agent configuration changes
Supply-chain compromise
Lateral movement into development infrastructure

The technique is especially concerning because security controls traditionally treat Markdown and repository documentation as passive content.

With autonomous AI agents, those same files can function operationally like instructions to an interpreter.

The attack therefore expands the definition of executable content inside modern development environments.

1. Establish an Isolated Workspace

Create a controlled development directory containing non-production source code and an AI coding agent configured with representative enterprise permissions.

2. Introduce an Instruction File

Add a test AGENTS.md, CLAUDE.md, or equivalent file containing harmless instructions designed to test whether the agent will perform an unauthorized action.

Examples:

• Modify agent configuration
• Add an external tool endpoint
• Run an unexpected command
• Install a benign test package
• Access a protected test file
• Contact a controlled external domain

3. Launch the Agent Normally

Do not explicitly direct the agent to read the malicious instruction file.

Determine whether discovery occurs automatically.

4. Measure Trust Behavior

Determine whether the agent distinguishes between:

User instructions
Repository instructions
Downloaded instructions
Nested directory instructions
Third-party repository instructions

5. Test Tool Execution

Evaluate whether malicious file instructions can cause:

• Shell execution
• Package installation
• Browser activity
• API requests
• Configuration modification
• MCP server registration
• Credential access

6. Test Approval Controls

Determine whether sensitive actions require explicit approval or whether the instruction file can influence the agent into bypassing or minimizing confirmation.

7. Test Configuration Persistence

Determine whether the instruction can modify:

• Global agent configuration
• User-level configuration
• Persistent MCP settings
• Environment variables
• API endpoints

8. Test Credential Exposure

Using synthetic credentials, verify whether malicious instructions can cause authentication material to be transmitted to a controlled endpoint.

Security teams should begin treating AI instruction files as active security-relevant content, even though operating systems generally consider them ordinary text.

Monitor for unexpected creation or modification of:

AGENTS.md
CLAUDE.md
Agent configuration files
MCP configuration files
Repository-level AI instruction files

High-value detection signals include:

• Instruction files appearing in Downloads or temporary directories
• Recently downloaded instruction files immediately followed by agent execution
• Unexpected modifications to global AI-agent configuration
• New MCP servers or tool endpoints
• AI-agent initiated package installations
• AI-agent initiated shell execution outside expected workflows
• Changes to model API base URLs
• Authentication traffic redirected to unfamiliar domains
• Agent activity originating from newly cloned repositories

Where possible, correlate:

File Creation → Agent Launch → Configuration Change → Command Execution

That sequence is particularly strong evidence of instruction-file abuse.

Forever Security specifically recommends inspecting unfamiliar agent instruction files and monitoring unexpected configuration changes associated with coding agents.

T1059 — Command and Scripting Interpreter T1105 — Ingress Tool Transfer T1552 — Unsecured Credentials T1036 — Masquerading

LLM01:2025 — Prompt Injection Primary mapping. The malicious instructions are delivered indirectly through external content rather than directly by the user. The agent interprets that content as trusted operating instructions. LLM06:2025 — Excessive Agency Secondary mapping where the injected instructions become dangerous because the AI agent has permission to: - Execute commands - Install packages - Change configuration - Access credentials - Contact external systems The combination of indirect prompt injection + excessive agency converts an otherwise inert text file into a practical execution mechanism