Stop Untrusted Repo Files From Steering Coding Agents

Description and use

<p>A coding agent can inherit instructions from a file that your team did not write, review, or even notice. If it also has permission to edit configuration, install packages, or reach the internet, a routine coding task can become an access-control problem.</p> <p>This is no longer just a prompt-quality issue. Forever Security reports that a malicious <code>AGENTS.md</code> placed in a Downloads folder prompted Codex to add an MCP server and install a malicious npm package in more than 90% of its test runs. The report also describes a <code>CLAUDE.md</code> variant that redirected Claude Code

Problem

<p>A coding agent can inherit instructions from a file that your team did not write, review, or even notice. If it also has permission to edit configuration, install packages, or reach the internet, a routine coding task can become an access-control problem.</p> <p>This is no longer just a prompt-quality issue. Forever Security reports that a malicious <code>AGENTS.md</code> placed in a Downloads folder prompted Codex to add an MCP server and install a malicious npm package in more than 90% of its test runs. The report also describes a <code>CLAUDE.md</code> variant that redirected Claude Code

Outcome

<p>A coding agent can inherit instructions from a file that your team did not write, review, or even notice. If it also has permission to edit configuration, install packages, or reach the internet, a routine coding task can become an access-control problem.</p> <p>This is no longer just a prompt-quality issue. Forever Security reports that a malicious <code>AGENTS.md</code> placed in a Downloads folder prompted Codex to add an MCP server and install a malicious npm package in more than 90% of its test runs. The report also describes a <code>CLAUDE.md</code> variant that redirected Claude Code

Evidence

Stop Untrusted Repo Files From Steering Coding Agents

Source