When you code with AI, the developer's machine becomes the target

You open a terminal, start your coding agent and ask it to fix a bug. Nothing unusual. Except the terminal opened in your Downloads folder, and an instruction file had been waiting there since the day before.

In my previous article, With AI, staying in control of your architecture, I talked about the framework you set before the first prompt. There is another framework to watch: the machine the agent works on. In late October, two cases showed it has become a target in its own right.

An agent also obeys the files it finds

Agents like Codex or Claude Code automatically read an instruction file placed in the folder they start in (AGENTS.md, CLAUDE.md). It's handy: you describe your conventions once and for all.

Researchers showed that a simple web page can drop such a file into Downloads without the user noticing. If the agent is started from that folder, it follows those instructions. According to BleepingComputer, the attack succeeded 90% of the time with Codex, and a variant on Claude Code could redirect API traffic and steal the login token.

No fix is planned, and that makes sense: the agent is doing exactly what it was designed to do.

The folder you start an agent in is part of its prompt.

An extension can hide much more than a feature

A few days later, a trojanized version of the Claude Code extension (2.1.313) was circulating on the Cursor marketplace. It added an SSH key named "svc-telemetry", opened a reverse SSH tunnel and made itself persistent through a scheduled task. According to The Hacker News, it may have been installed up to 5,000 times.

The trap is well chosen. We install an AI extension to save time, we grant it broad permissions, and we almost never check who publishes it or what an update changes.

A tool that writes in our code can also write on our machine.

A few habits are enough to close the door

None of this means giving up on agents. You just need to treat them for what they are: programs acting with our permissions.

• Start the agent only at the project root, never from ~ or Downloads.
• Keep approvals enabled for commands and file writes.
• Read the instruction file of a repository you just cloned, as you would read an install script.
• Install extensions from their official publisher and keep an eye on their updates.
• Check ~/.ssh/authorized_keys and your machine's scheduled tasks from time to time.

For the extension, version 2.1.314 fixes the problem. You also need to remove the key, delete the persistence and change your credentials.

And you, do you know exactly what your agent reads before answering you?