AI coding agents fall for malicious instructions planted in the Downloads folder

A file that a website saves to the Downloads folder without approval can trick AI coding agents into installing a malicious npm package or handing over the user’s login token when they’re opened in that folder, Forever Security has found. The file is called AGENTS.md, a plain text document developers place in a project folder with instructions for coding agents, the AI tools that write and run code on their own. One turned up on … More → The post AI coding agents fall for malicious instructions