Planted AGENTS.md file in Downloads folder hijacks AI coding agents

Oct 25, 2026 · Issue 12 · 4 sources, 4 articles

Researchers showed that an AGENTS.md file placed in the Downloads folder can hijack AI coding agents (reports on Oct. 25). The attack exploits the instruction file that agents read automatically.

Who is affected and how

senior developer

Before starting an agent, check which instruction files the working directory and surrounding folders contain.

Narrative: The coding agent is the new attack surface

Sources

• AI coding agents hijacked using AGENTS.md file in Downloads folderbleepingcomputer · Oct 25, 2026
• AI coding agents hijacked using AGENTS.md file in Downloads folder - BleepingComputerbleepingcomputer.com · Oct 25, 2026
• Forever Security Says It Caught a Planted AGENTS.md File in a Customer's Downloads Folder Ordering OpenAI's Codex to Install Malware, and Showed a Similar Trick Can Steal Claude Code's Login Token · SOCtembersoctember.com · Oct 25, 2026
• AGENTS.md attack: how AI coding agents are hijackedbytepoint.hu · Oct 25, 2026 · magyar

Machine-generated summary based on the titles and excerpts of the source articles. The facts come from the linked article.