Indirect prompt injection via repository files hijacks coding agents

Forever Security showed that a malicious AGENTS.md in a cloned repository made Codex add an MCP server and install a malicious npm package in over 90% of test runs. A CLAUDE.md variant redirected Claude Code's API traffic, with no executable code involved. Mitigations include provenance tagging and explicit file-read tool calls.

• Malicious AGENTS.md made Codex install a package in 90%+ of runs
• A CLAUDE.md variant redirected Claude Code's API traffic
• The files held plain-text instructions, no executable code
• Proposed fixes: trust tags on context and explicit file reads