AI coding agents hijacked using malicious AGENTS.md instruction file

# AI coding agents hijacked using malicious AGENTS.md instruction file

https://gcdradar.vercel.app/incidents/ai-coding-agents-hijacked-using-malicious-agents-md-instruct · AIR-2026-1507 · closed 2026-11-08

- Lane: Research
- Severity: 1 (Research / proof of concept)
- Fix status: Fix status unknown
- First reported: 2026-10-25
- AI role: Attack on AI
- Products: AI coding agents

## Summary

Researchers discovered a malicious markdown instruction file placed inside a Downloads folder that tricked an AI coding agent into executing unauthorized actions. The attack successfully forced the agent to install a rogue npm package.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-10-25: AI coding agents hijacked using AGENTS.md file in Downloads folder (https://bleepingcomputer.com/news/security/ai-coding-agents-hijacked-using-agentsmd-file-in-downloads-folder)

## Sources

- 2026-10-25 BleepingComputer: AI coding agents hijacked using AGENTS.md file in Downloads folder https://bleepingcomputer.com/news/security/ai-coding-agents-hijacked-using-agentsmd-file-in-downloads-folder
- 2026-10-26 The Hacker News: Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware https://thehackernews.com/2026/10/malicious-file-in-downloads-folder.html

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.