Plan
active
AI coding agents hijacked via malicious AGENTS.md in Downloads folder
- Engineer — Plan: A real-world case of indirect prompt injection: a malicious AGENTS.md file in a Downloads folder redirected an AI coding agent to install a rogue npm package. Audit your system for unexpected AGENTS.md (or similar instruction) files in user-accessible directories, and restrict your AI coding agent’s trusted file-read scope to the project root.
- SOC/IR — Plan: This establishes a new TTP: adversaries plant instruction files (AGENTS.md) in directories that AI coding agents scan, triggering unauthorized package installs. Build a hunt for AGENTS.md or equivalent agent-config files outside expected project roots, and add detections for anomalous package manager invocations spawned by AI agent processes.
- Leader — Plan: If your engineering org uses AI coding agents (Claude Code, Copilot, Cursor, etc.), this attack class — poisoning agent instruction files to hijack developer workflows — warrants a policy before it matures further; define which directories agents may trust for instruction files and require developer awareness training this quarter.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.