Markdown becomes the new executable: instruction file poisoning of AI coding agents

CSA published a research note analyzing instruction file poisoning of AI coding agents: Markdown files such as AGENTS.md and CLAUDE.md are automatically loaded by agents as trusted guidance, and can induce them to install malicious packages, rewrite settings or exfiltrate credentials. In October 2026, a Forever Security report found a malicious AGENTS.md in a user's Downloads folder; in researchers' reproduction, OpenAI Codex executed a benign substitute payload in more than 90% of cases, and a companion CLAUDE.md caused Claude Code to redirect API traffic in about half of cases. The note states that the latest variants do not exploit software vulnerabilities; after vendors patched loading-time flaws, attacks shifted to persuading agents within trusted sessions to write dangerous configurations themselves; in June 2026, after the Miasma worm dropped configuration files in Azure/durabletask, GitHub disabled 73 repositories.