AI coding agents hijacked using AGENTS.md file in Downloads folder
Posted by PrivacyWire
A malicious AGENTS.md file in an ordinary Downloads folder was able to influence an AI coding agent, showing that local files can become an overlooked attack surface. Installing a rogue npm package could expose code, credentials, or other sensitive data to an attacker. Have you seen coding agents treat untrusted local instructions as trustworthy?