AI/Security/Attack/Prompt/Injection/Instruction File Poisoning

• Instruction File Poisoning

  • An attacker places instructions in a file that a coding agent loads as project guidance. This is a form of AI/Security/Attack/Prompt/Injection: untrusted content gains influence over tool use through a trusted-looking instruction file.

  • Downloads as an entry point

    • Forever Security’s October 22, 2026 investigation reports finding a malicious AGENTS.md in a customer’s ~/Downloads. The initial delivery method was unknown. The researchers demonstrated browser delivery followed by starting an agent in that directory.
    • Their Codex demonstration changed machine-wide MCP configuration and launched another session to run malicious tooling. Their separate Claude Code demonstration used CLAUDE.md to redirect API traffic and expose an OAuth token. These are reported demonstrations, not evidence that every agent or permission configuration is vulnerable.
    • The file is plain text. The agent supplies execution capability after loading it; downloading Markdown alone does not execute commands. Browser download settings, filename handling, instruction discovery, workspace trust, and execution permissions all affect the chain.

  • Which files become instructions

    • Related instruction-file topics: Claude/Code/Claude.md and AI/Coding/Agents.md.
    • Claude Code’s memory documentation describes ancestor instructions loaded at launch and nested instructions loaded on demand. Current versions can load AGENTS.md depending on the presence of CLAUDE.md and configuration. A file outside the loaded scope does not automatically become project guidance merely because it is in Downloads.
    • OpenAI’s Codex prompting guide describes instruction discovery from global configuration and the repository-root-to-working-directory path. Discovery rules vary by product and version; inspect what the actual session loaded.

  • Controls to evaluate

    • Keep browser downloads outside trusted workspaces. Review downloaded instruction files before promoting them into a workspace. A launcher can reject untrusted working directories, including resolved paths that reach them through symlinks.
    • Lint agent configuration for unexpected instruction sources, MCP servers, API endpoints, broad permissions, and disabled isolation. Repeat checks after changes. Linting detects known conditions; it cannot establish that arbitrary natural-language instructions are safe.
    • Use centrally managed settings and operating-system restrictions for enforcement. Claude Code’s security guidance distinguishes permission prompts from sandbox boundaries and recommends managed settings and auditing configuration changes. A prose instruction to distrust a path is behavioral guidance, not an operating-system access restriction.
    • Devcontainers can reduce exposure when host Downloads, user configuration, credentials, and privileged sockets are not mounted into them. Their value depends on mounts, permissions, and outbound network access. Provisioning can establish defaults; runtime enforcement must keep a compromised session from changing them.