Malicious AGENTS.md File Used to Hijack AI Coding Agents Into Installing Rogue npm Package

What Happened

Researchers reported finding a malicious AGENTS.md file planted in a customer's Downloads folder, according to BleepingComputer. AGENTS.md files are plain-text instruction files that some AI coding agents automatically read and follow as context when operating in a directory. In this case, the file contained instructions that tricked an AI coding agent into installing a rogue npm package. Beyond this summary, further technical details — such as the specific agent involved, the package name, or its payload — have not been confirmed.

Why It Matters

This incident highlights a growing class of risk as AI coding agents are given more autonomy to read local files and execute actions like package installs on a developer's behalf. Agent-instruction files such as AGENTS.md are typically treated as trusted configuration, but if an agent ingests one from an untrusted location — like a Downloads folder where arbitrary files land from browsers, email, or removable media — it can be steered into performing actions the developer never intended, including installing malicious dependencies into a project or environment.

What Defenders Should Watch For

• Inventory where AI coding agents in your environment look for and auto-load instruction/context files (e.g., AGENTS.md, similar agent config files), and whether that scope includes user-writable or download directories.
• Review agent configurations to restrict file-context ingestion to trusted project directories rather than the broader filesystem or home folder.
• Monitor for unexpected npm (or other package manager) installs initiated by developer tooling, especially packages not present in lockfiles or added outside normal code-review workflows.
• Treat any unfamiliar AGENTS.md, .cursorrules, or similar agent-instruction file discovered outside a project's version control as suspicious until reviewed.
• Apply standard supply-chain hygiene — package allowlisting, install-time scanning, and code review of dependency changes — as a backstop against agent-driven installs.

Developing Intel

This is a newly reported technique with limited public detail at this time; specifics may be clarified as researchers publish further analysis. For the original report, see BleepingComputer's coverage.