A quiet but consequential discovery has surfaced in the security world: the humble instruction files that help AI coding assistants understand a project can, when they arrive from an untrusted source, redirect those assistants toward the purposes of someone else. The finding, reported by BleepingComputer and carried into the news stream in late October 2026, reflects an older human pattern, the trust we extend to whatever sits within reach of our tools. It reminds us that a machine following instructions cannot always tell a colleague's note from a stranger's, and that the convenience of autom
AI Coding Agents Can Be Hijacked Through an AGENTS.md File in the Downloads Folder
An agent has no reason to distinguish a file the developer wrote from one that arrived.
Mark
So what actually happened here? A file in Downloads can control an AI agent?
Mimi
That's the report. Researchers say a malicious AGENTS.md file, placed in a folder like Downloads, can steer a coding agent that reads it.
Mark
Why does that file matter so much?
Mimi
Agents read AGENTS.md to get instructions about a project. It works like standing orders, so whoever writes the file gets a voice in what the agent does.
Luke
Before we go further, how much do we really know? What I see is a headline and a short summary.
Mimi
Fair. We don't have the technical details, and we don't know which agents or vendors are affected.
Mark
Why Downloads specifically?
Mimi
It's where unvetted files pile up. An agent that treats anything it finds as trusted is exposed to whatever lands there.
Luke
And nobody has said this has been used against real people. That's unconfirmed, and so is what an attacker could make an agent do.
Mark
So what do we watch for?
Mimi
Vendor patches, guidance on limiting which folders agents can read, and any sign of the attack in the wild.
Luke
Those are the things that would turn a research claim into something measurable.
O Pulso
- A plain text file named AGENTS.md, dropped into a Downloads folder, can apparently seize control of a coding agent that reads it.
- The disruption lands on developers who trust their tools to act on project guidance without questioning where that guidance came from.
- Researchers have surfaced the risk, and the response now turns on whether vendors will patch agents or restrict which files they will obey.
- Details remain sparse, with no confirmed list of affected tools and no reported attacks on real victims, so the situation is still taking shape.
A quiet but consequential discovery has surfaced in the security world: the humble instruction files that help AI coding assistants understand a project can, when they arrive from an untrusted source, redirect those assistants toward the purposes of someone else. The finding, reported by BleepingComputer and carried into the news stream in late October 2026, reflects an older human pattern, the trust we extend to whatever sits within reach of our tools. It reminds us that a machine following instructions cannot always tell a colleague's note from a stranger's, and that the convenience of automatic guidance carries its own vulnerability.
A short headline from BleepingComputer, picked up by Google News on October 25, 2026, makes a specific claim: an AI coding agent can be hijacked by a malicious file called AGENTS.md sitting in a Downloads folder. The material is thin, offering a headline and summary rather than a full technical account, so the story can only be told as far as that summary reaches.
AGENTS.md is a configuration file that coding agents read to learn the instructions of a project, guidance a developer would otherwise repeat by hand. The agent treats what it finds there as direction. That trust is the source of the risk. According to the report, an attacker's copy of such a file in a local folder can take over the agent and steer its actions, a pattern closely related to prompt injection, where text is read and obeyed as though it came from the legitimate user.
The Downloads folder is a fitting setting for this threat, since it collects files from email, web pages and shared links, many of them never examined. The agent, however, has no way to tell a file the developer wrote from one that simply arrived.
Much remains unknown. The report does not name the affected agents or vendors, explain how the demonstration was done, or describe what an attacker could force an agent to do. No real-world victims are reported. What to watch next is whether vendors issue patches or change how they choose instruction files, whether guidance on restricting agent folder access appears, and whether the technique is ever seen outside research.
The headline is short and the claim in it is specific: an AI coding agent can be hijacked by a file called AGENTS.md sitting in a Downloads folder. BleepingComputer, the security news outlet, reported the finding, and Google News carried the headline on October 25, 2026. The material available is thin. It gives a headline and a summary, not a full technical write-up, so what follows is limited to what that summary supports.
AGENTS.md is a configuration file. Coding agents read it to pick up instructions about a project, the kind of guidance a developer would otherwise have to type out each time. The file is plain text, and the agent treats what it finds there as direction.
That is where the risk lies. According to the researchers' report, a malicious AGENTS.md placed in a local folder, in this case the Downloads folder, can take over an agent that reads it. The attacker's instructions end up steering what the agent does. The reporting describes this as a hijack, and the keywords attached to the story point to prompt injection as the underlying category: text that an AI system reads and then obeys as though it came from its legitimate user.
The Downloads folder is a telling choice. It is where files from email attachments, web pages and shared links tend to land, and it is often full of items nobody has examined closely. The central point of the report is that an untrusted copy of an instruction file is a risk precisely because agents are built to trust such files. An agent has no reason to distinguish a file the developer wrote from one that arrived from somewhere else, if both are found where it looks.
Several things are not established by the material at hand. It does not name which coding agents are affected, which vendors are involved, or how the researchers carried out the demonstration. It does not say what specific actions an attacker could force an agent to take, and it does not report any case of this being used against real victims. The confidence in the underlying account is moderate, which fits a story built from a single outlet's summary of researcher findings.
What to watch is fairly clear. Vendors of coding agents may issue patches or change how their tools decide which instruction files to read. Guidance may appear on restricting the folders an agent can access. And the open question is whether anyone sees this technique used outside a research setting. Until then, the finding stands as a warning about how much authority a text file can carry when an agent is told to listen to it.
Citações Notáveis
Researchers report that a malicious AGENTS.md file in a Downloads folder can let attackers steer an AI coding agent's actions.— Summary of BleepingComputer reporting
Quer a matéria completa?
Leia o original em Google News ↗
Technology