Malicious AI Instruction Files: An Incident Teardown

Your AI coding assistant just exfiltrated your API keys, database credentials, and proprietary code snippets. You didn't notice because it happened inside a tool you trust, using a file type your security stack doesn't monitor.

What Happened

Mitiga researchers discovered multiple cases of agent instruction file poisoning in GitHub repositories. These malicious files target AI agents like Claude Code by injecting commands that alter the agent's behavior. The attack, known as PromptLogger, captures prompts and sometimes responses exchanged with the AI, then sends them to attacker-controlled endpoints.

These files don't execute code on your machine. Instead, they manipulate the AI agent, turning your productivity tool into a data exfiltration channel. The instructions are in configuration files that developers routinely pull from shared repositories, making distribution easy and detection hard.

Timeline

While the exact timeline of incidents isn't public, the pattern is clear:

1. Attacker plants malicious instruction files in public repositories or shared codebases.
2. Developer clones or pulls the repository containing the poisoned file.
3. AI agent reads the instruction file during its normal startup or context-loading process.
4. Agent follows the malicious instructions alongside legitimate ones.
5. User interacts with the AI agent, unaware of the compromise.
6. Agent captures prompts, responses, or both and sends them to attacker infrastructure.
7. Exfiltration continues until the malicious file is discovered or the repository is updated.

The attack remains undetected because it doesn't trigger traditional security alerts. No unusual processes spawn. No suspicious network connections are made. The AI agent itself makes the outbound connection as part of its designed functionality.

Which Controls Failed or Were Missing

Configuration File Validation
Your team likely scans code for vulnerabilities and secrets, but AI instruction files aren't code. They're configuration, and most security tools don't parse them for malicious directives. These files passed through code review and automated scanning because no one was looking for instruction-level manipulation.

Network Egress Monitoring
AI agents make legitimate external API calls constantly. Without granular monitoring of what data those calls contain, you can't distinguish between normal operation and data exfiltration. Your network monitoring saw the connection, categorized it as expected AI traffic, and moved on.

Least Privilege for AI Agents
The agents had access to everything in the developer's context: environment variables, open files, command history, clipboard contents. No one scoped their permissions because they're still treated like text editors instead of autonomous processes with network access.

Supply Chain Verification
Developers pull instruction files from the same repositories they pull code from, but these files bypass the verification steps you apply to dependencies. No signature checking, no provenance validation, no review of what instructions the file contains.

What the Relevant Standards Require

PCI DSS v4.0.1 Requirement 6.3.2 mandates identifying and addressing common coding vulnerabilities. While it focuses on traditional code, the principle extends to any component processing sensitive data. If your AI agents handle cardholder data, validate their configuration files as rigorously as application code.

OWASP Top 10 2021: A08:2021, Software and Data Integrity Failures addresses this scenario. Pulling configuration files from external sources without verification introduces integrity risk. The standard calls for verifying that configuration and dependencies come from trusted sources and haven't been tampered with.

ISO/IEC 27001:2022 Annex A.8.31 requires security for development and support processes. Your AI-assisted development workflow is part of that process. If you haven't assessed the security implications of AI agents accessing your codebase and making network calls, you have a gap.

NIST Cybersecurity Framework v2.0 PR.DS-6 states that integrity checking mechanisms verify software, firmware, and information integrity. AI instruction files are information that directly affects system behavior. They need integrity verification.

The standards don't specifically mention AI instruction files because they're too new, but the control objectives are clear: validate configuration, verify integrity, apply least privilege, monitor egress.

Lessons and Action Items for Your Team

Inventory Your AI Agent Usage
List every AI tool your developers use that reads configuration or instruction files. Document where those files come from, who can modify them, and what permissions the agents have. You can't secure what you haven't cataloged.

Treat Instruction Files as Code
Apply the same review and scanning processes to AI instruction files that you apply to code:

• Require pull request reviews for any changes
• Scan for suspicious URLs, external endpoints, or data capture directives
• Version control them separately from user preferences
• Sign and verify them if your AI platform supports it

Implement Egress Monitoring for AI Traffic
Your SIEM or network monitoring should flag when AI agents:

• Connect to domains outside your approved list
• Transmit data volumes inconsistent with normal API usage
• Make requests to paste sites, file sharing services, or database endpoints

Scope AI Agent Permissions
Run AI agents with minimal necessary access:

• Use separate environment configurations for AI tools that don't include production credentials
• Limit file system access to specific project directories
• Consider running agents in containers with restricted network policies

Build Detection Rules
Create alerts for:

• New instruction files appearing in repositories
• Changes to existing instruction files from unexpected contributors
• Network connections from AI agent processes to unfamiliar endpoints
• Unusual data volumes in AI agent API calls

Update Your Threat Model
Add "AI agent manipulation" as an attack vector in your threat modeling sessions. Consider how an attacker could abuse the tools your team uses daily, not just the applications you build.

The PromptLogger technique works because it exploits trust: trust in repositories, trust in AI tools, trust that configuration files are benign. Your security controls need to verify that trust at every step, because the next supply chain attack might not target your dependencies, it might target the instructions your AI assistant follows.