Researchers found a malicious AGENTS markdown instruction file in a customer's Downloads folder that tricked an AI coding agent into installing a rogue npm package.
AI coding agents hijacked using AGENTS.md file in Downloads folder
About this summary. This is a short excerpt from the description that BleepingComputer published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.bleepingcomputer.com/news/security/ai-coding-agents-hijacked-using-agentsmd-file-in-downloads-folder/
Source attribution: headline and facts are from BleepingComputer (bleepingcomputer.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
AI coding agents fall for malicious instructions planted in the Downloads folder
A file that a website saves to the Downloads folder without approval can trick AI coding agents into installing a malicious npm package or handing over the user’s login…
Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware
A malicious instruction file sitting in a developer's Downloads folder tried to make their AI coding agent install a known-malicious npm package, security firm Forever…
Introducing tsrs: a Port of TypeScript to Rust
Cloudflare and VoidZero are now working with Max Schwenk of Owner.com on tsrs, a Rust port of the TypeScript compiler. We are doing this work in close collaboration with…
Secrets Management Firm Infisical Valued at $600 Million After $40 Million Raise
The company will use the Series B funds to expand its platform for securing AI agents’ access to sensitive systems.
What Happens Next: Turn Cloud Security Assessment Findings Into Action
What Happens Next: Turn Cloud Security Assessment Findings Into Action October 28, 2026 Adrian Pascual BLOG 5 min. Cloud security assessments are good at finding…
PHP2Shell and the Future of AI-Discovered Vulnerability Disclosure: Evidence, Verification, and Human Authority
arXiv:2610.36334v1 Announce Type: new Abstract: AI-assisted vulnerability discovery can produce technically plausible findings faster than maintainers can validate…