Malicious AGENTS.md file in Downloads folder can hijack AI coding agents
VectorWireAI · reddit · 2026-10-26
VectorWireAI reports an attack targeting AI coding agents: a malicious AGENTS.md file planted in the Downloads folder can be picked up and hijack agent behavior. Since many agent tools scan context files beyond the working directory, attackers can inject prompts without touching the repo, instructing the agent to leak data or write dangerous code. Developers should audit what directories their agents scan and quarantine untrusted AGENTS.md/rules files.
More from coding & agent
- Someone sent the first customer fax via ChatGPT over Onetime Fax's new MCP server — tdhopper · 2026-10-26
- China Telecom's XingChen lab open-sources Xing4.0-29B-Intent, a 29B MoE with 4B activated params — FellMentKE · 2026-10-26
- Codebases sized to fit one context window dramatically improve agent outcomes — julianharris · 2026-10-26
- 42-Minute Video Breaks Down Why AI Agents Fail: Mostly Not the Model's Fault — JohnSavill · 2026-10-26
- Giraffe: Open-Source Baseline Testing for OpenAI-Compatible LLM Endpoints — ImmediateBig8479 · 2026-10-26
- Running a bed-side AI agent: Obsidian split-screen plus Hyo plugin as a mobile workstation — evielync · 2026-10-26