Quick answer
To stop an AI coding agent following hidden instructions, only start it inside a clean project folder you control, never in Downloads or your desktop, and keep approval switched on for installs and commands. Coding agents automatically read instruction files such as AGENTS.md or CLAUDE.md in the folder they start in, and they can’t reliably tell your instructions from an attacker’s. Add a quick review of any instruction files, limit network access and secrets, and check every package the agent wants to install. That blocks the attack researchers reportedly used, where a file dropped into a Downloads folder steered agents in about half of tests.
Key takeaways
- Agents trust the folder they start in. Instruction files there are read as if you wrote them.
- Never launch an agent in Downloads, Desktop or your home folder. Anything can land there.
- Keep manual approval on for installing packages, running scripts and network calls.
- Keep secrets out of reach: no live API keys or tokens in the project folder.
- Read instruction files before you trust a cloned project. It takes a minute.
📘 Main article: This guide follows our Anthropic recursive self-improvement and AI news round-up, which covers the research showing coding agents can be hijacked by a single file.
In this guide
- Why do AI coding agents follow instructions hidden in files?
- Which folders and files are risky?
- How do you stop an AI coding agent following hidden instructions?
- Which agent settings should you change?
- What are the signs an agent has been hijacked?
- What should you do if an agent ran something suspicious?
- Frequently asked questions
- The bottom line
- Related posts
AI coding agents such as Claude Code and Codex are brilliant at getting work done from a short request. Part of what makes them useful is that they read project notes and instruction files automatically. That is also their weak spot.
This guide shows you how to stop an AI coding agent following hidden instructions that you didn’t write. You don’t need to be a developer to follow it. It builds on the security research covered in our main article on this week’s AI news.
Why do AI coding agents follow instructions hidden in files?
Because to an AI model, instructions are just text, and it can’t always tell whose text it is reading. Many coding agents look for a file such as AGENTS.md or CLAUDE.md when they start, and treat it as guidance from you. This is called prompt injection when an attacker uses it.
According to the research reported by WorldofAI, a malicious website could place an instruction file in a Downloads folder. If you later launched a coding agent from that folder, it could follow the attacker’s instructions, including trying to install harmful software packages. Claude Code was reportedly compromised in roughly 50% of the tests.
The researchers said there is no single bug for AI companies to fix. So the protection comes from how you set up and run your agent.
Which folders and files are risky?
| Location or file | Risk level | Why |
|---|---|---|
| Downloads folder | High | Websites and email attachments can put files there without you noticing |
| Desktop or home folder | High | Lots of unrelated files and hidden settings files |
| A project you cloned from the internet | Medium | Its instruction files were written by someone else |
| Shared or synced folders | Medium | Other people or apps can add files |
| A fresh folder you created for one project | Low | You know what is in it |
Files to look out for include AGENTS.md, CLAUDE.md, other .md instruction files in the project root, and hidden folders whose names start with a full stop. They are normally harmless, but you should know what they say.
How do you stop an AI coding agent following hidden instructions?
Work through these steps once, then make them a habit.
- Create a dedicated projects folder. For example,
Documents/projects/, with one subfolder per project. - Always open your terminal in that project folder before starting the agent. If you aren’t sure where you are, check before you type the agent command.
- Never start an agent in Downloads, Desktop or your home folder. Move the files you need into a project folder first.
- Read instruction files in anything you clone. Open
AGENTS.mdorCLAUDE.mdand skim for anything odd, such as commands to install packages, download scripts, change settings or send data somewhere. - Ask the agent to plan before it acts. A prompt like “Tell me which files you have read and what you plan to do before making changes” brings hidden instructions into the open.
- Review every install. If the agent wants a package you didn’t expect, ask why, and check that the package name is spelled correctly and is well known.
- Clear out Downloads regularly. Fewer stray files means fewer surprises.
💡 Tip: Treat instruction files like code. If you wouldn’t run a script from a stranger, don’t let your agent follow their notes either.
Want the bigger picture? Our Anthropic recursive self-improvement round-up explains why faster, more capable agents make these basic habits more important.
Which agent settings should you change?
Most coding agents let you choose how much they can do without asking. The names vary between tools, but the principles are the same.
- Keep approval on for commands and installs. Avoid “skip all permissions” or fully automatic modes unless you are in a throwaway environment.
- Limit network access where your tool allows it, so the agent can’t freely contact unknown servers.
- Keep secrets out of the project. Store API keys outside the folder and use restricted, low-limit keys for testing. Our guide on storing AI API keys safely explains how.
- Use a sandbox or spare machine for experiments with unfamiliar code. A cloud computer or container is ideal.
- Set spending limits on your AI provider accounts, so a stolen key can’t run up a huge bill.
⚠️ Warning: Fully automatic modes are convenient, but they remove the moment where you would spot a strange install. Only use them in a sandbox with no access to your real accounts.
What are the signs an agent has been hijacked?
- The agent installs a package you never mentioned, or one with an odd spelling.
- It runs commands that download and run scripts from the internet.
- It changes settings files, environment variables or where requests are sent.
- It mentions instructions you don’t remember giving.
- Your AI provider dashboard shows usage you can’t explain.
Any of these is a reason to stop the agent and look more closely.
What should you do if an agent ran something suspicious?
- Stop the agent straight away.
- Disconnect from the internet if you think something harmful was installed.
- Rotate your API keys and tokens in each provider’s dashboard, and check recent usage.
- Remove any packages it installed that you didn’t ask for, and run a security scan.
- Find and delete the instruction file that caused it, then start again in a clean folder.
- Get professional help if the computer holds business or customer data.
Attackers increasingly want AI keys because they can be resold or used to run up bills. Our article on why attackers want your AI keys covers what to watch for.
Frequently asked questions
What is an AGENTS.md file?
It is a plain text instruction file that many AI coding agents read automatically when they start in a folder. It is useful for project notes, but anyone who can put a file in that folder can use it to give your agent instructions.
Is Claude Code safe to use?
It can be used safely with sensible habits. The reported research found it could be steered in about half of tests when started in a folder containing a malicious instruction file, so start it only in clean project folders and keep approvals on.
Does this affect Codex and other coding agents too?
The researchers described it as a general problem with agents treating untrusted text as instructions, so assume any coding agent can be affected and use the same checklist.
Will AI companies fix this?
They are improving defences, but the researchers argued there is no single bug to patch. Your setup and habits remain the most reliable protection.
Do I need to be a developer to stay safe?
No. The main steps are choosing the right folder, keeping approvals on and reading what the agent plans to do.
The bottom line
AI coding agents follow the instruction files they find, so the folder you start them in matters. Keep a clean projects folder, never launch an agent from Downloads, read instruction files in anything you clone and keep approval on for installs. Your next step: create a dedicated projects folder today and move your agent work into it.
Related posts
- Anthropic Recursive Self-Improvement: What the IPO Filing Change Means, Plus Fable 5.5 and This Week’s AI News
- How to Keep Your AI Agent Safe When It Browses the Open Web
- How to Stop an AI Agent Sending Your Data Online Without Permission
[…] How to Stop an AI Coding Agent Following Hidden Instructions in Your Files — keep coding agents from obeying instruction files you didn’t write, with a simple folder and approval checklist […]