Security researchers have discovered an emerging attack vector where weaponized Markdown files—such as AGENTS.md and CLAUDE.md—trick autonomous AI coding assistants into executing arbitrary commands and leaking API credentials. For Ubuntu and Linux developers relying on terminal-based coding agents, launching these tools in untrusted directories can compromise local configuration files and environment tokens. Mitigating this threat requires container isolation, context auditing, and strict Model Context Protocol validation.
The Rise of Context-Poisoning Attacks
Modern developer workflows increasingly incorporate command-line artificial intelligence agents like OpenAI Codex implementations, Anthropic's Claude Code, and autonomous tools like Aider. To align with a project's architecture, these utilities automatically parse local guidance documents stored at the project root—conventionally named AGENTS.md, CLAUDE.md, or .cursorrules. These files provide system prompts that tell the model which build tools to use, how to format code, and what test suites to run.
However, treating plain text documentation as an implicit control plane introduces severe vulnerabilities. As documented by cybersecurity research firm Forever Security in a case covered by Taiwanese cybersecurity publication iThome, attackers have begun weaponizing these markdown guidance files. By placing crafted instructions inside downloaded directories or shared repositories, an adversary can mount a prompt-injection attack that forces the AI agent to bypass local sandbox boundaries and execute malicious shell scripts on the host machine.
~/Downloads folder or untrusted git repositories. Always verify hidden configuration files and workspace Markdown instructions before starting an autonomous session.
How the Exploit Hijacks MCP and NPM Ecosystems
The observed attack centered on an incident where an infected AGENTS.md file was discovered in a user's local downloads directory. When the target initiated an AI session, the agent digested the Markdown file as operational instructions. Rather than providing innocuous coding rules, the instructions instructed the model to silently alter its machine-level configuration, register a rogue Model Context Protocol (MCP) server controlled by the attacker, and install an unauthorized Node Package Manager (NPM) package named function-color.
The Model Context Protocol acts as an open interface connecting AI models to local development tools, APIs, and file systems. By hijacking this registration step, the attacker gains a persistent channel to issue commands. Furthermore, the malicious Markdown specifically commanded the agent to bypass human confirmation dialogues and ignore sandbox constraints. In controlled laboratory environments, researchers noted that OpenAI Codex followed these adversarial instructions in over 90 percent of test executions.
Token Exfiltration in Anthropic's Claude Code
The vulnerability extends beyond Codex. Researchers applied equivalent prompt injection techniques against Anthropic's terminal-based assistant, Claude Code, utilizing an adversarial CLAUDE.md file. The crafted context directed the agent to modify its underlying API endpoint routing. This redirected traffic allowed attackers to intercept local OAuth session tokens and authorization keys. In rigorous testing, approximately 50 percent of attempts successfully compromised the target agent's authentication configuration.
Comparative Analysis: Attack Surfaces Across AI Coding Agents
The following table outlines how adversarial Markdown files interact with different agent architectures and their respective security implications:
| Target Agent | Trigger Document | Exploitation Technique | Primary Objective | Observed Success Rate |
|---|---|---|---|---|
| OpenAI Codex Integration | AGENTS.md |
Rogue MCP Registration & NPM Injection | Remote Code Execution (RCE) via function-color |
> 90% |
| Anthropic Claude Code | CLAUDE.md |
API Routing Modification | OAuth Token Exfiltration & Session Hijacking | ~ 50% |
| Cursor / Custom LLM IDEs | .cursorrules |
Hidden Shell Commands in Context Blocks | Local Environment Variable Harvesting | Variable (Prompt Dependent) |
Hardening Ubuntu Workstations Against Markdown Hijacking
Because these exploits abuse the agent's legitimate ability to read local workspace instructions, traditional antivirus software often fails to detect the underlying prompt injection. Developers running Ubuntu and other Linux distributions must enforce proactive workspace hygiene, process isolation, and configuration monitoring.
1. Audit Workspace Markdown Files Before Running Agents
Before launching an agent inside a newly cloned project, search for hidden or suspicious instruction files. Check whether they attempt to override terminal execution flags, alter network endpoints, or install unverified packages:
# Search for instruction files across the active directory
find . -maxdepth 2 -type f \( -iname "*AGENTS.md" -o -iname "*CLAUDE.md" -o -iname "*.cursorrules" \)
# Scan instruction files for suspicious network or installation calls
grep -Ei '(curl|wget|npm install|mcp|server|proxy|token|auth)' AGENTS.md CLAUDE.md 2>/dev/null2. Isolate Coding Agents with Bubblewrap Sandboxing
Rather than running autonomous assistants directly with full user privileges, constrain them using bubblewrap (standard on modern Ubuntu systems). This creates an unprivileged sandbox that restricts the agent's view of your sensitive home configuration files and environment variables:
# Run an agent session in a sandboxed, isolated filesystem view
bwrap \
--ro-bind /usr /usr \
--ro-bind /lib /lib \
--ro-bind /lib64 /lib64 \
--ro-bind /bin /bin \
--ro-bind /etc /etc \
--proc /proc \
--dev /dev \
--tmpfs /tmp \
--bind "$PWD" "$PWD" \
--chdir "$PWD" \
--unshare-all \
--share-net \
/bin/bash3. Monitor Agent Configuration Integrity with Linux Audit Daemon
Configure auditd to monitor alterations to your user configurations and package managers. If an AI agent attempts to register an external MCP server or change your global CLI settings under ~/.config, the kernel logs the event immediately:
# Install the audit framework on Ubuntu
sudo apt update && sudo apt install -y auditd audispd-plugins
# Add a watch rule for user configuration directories
sudo auditctl -w /home/$USER/.config/ -p wa -k ai_agent_config_watch
# Review unauthorized modification attempts
sudo ausearch -k ai_agent_config_watch -ts recentConclusion: The Need for Least-Privilege AI
The discovery of weaponized Markdown attacks marks a significant evolution in developer supply-chain threats. When AI agents are granted access to terminal shells, package managers, and local files, treating unstructured documentation as verified instructions creates an unmonitored attack vector. Developers on Ubuntu and Linux environments must apply zero-trust principles to AI workflows: run coding agents inside containers, mandate human approval for MCP tool installations, and routinely rotate API tokens that could have been exposed during uncontained sessions.