AI coding agents fall for malicious instructions planted in the Downloads folder
A file that a website saves to the Downloads folder without approval can trick AI coding agents into installing a malicious npm package or handing over the user’s login token when they’re opened in that folder, Forever Security has found. The file is called AGENTS.md, a plain text document developers place in a project folder with instructions for coding agents, the AI tools that write and run code on their own.
Summary from Help Net Security.
Explained
The technology and terms in this story. Learn more
Related coverage
Other sources covering the same vulnerabilities or event.