Our takeForever Security showed that a website can drop AGENTS.md into your Downloads folder; when an AI coding agent opens a project there it follows the planted instructions and can be tricked into installing a rogue npm package. To avoid: run LLM jobs im separate directories and don't ask your agent to read md files outside its current directory.Security Resilience desk
What this means for you — Security leader:If your developers use AI coding agents (Cursor, Devin, Codex, etc.), block or monitor Downloads-folder access to those tools and scan for unexpected AGENTS.md files before they open any project.
What this means for you — Lean IT orgs:If you or your team use AI tools that write code, avoid letting them scan your Downloads folder and watch for any AGENTS.md file that suddenly appears there.
What this means for you — MSP:Advise clients using AI coding assistants to restrict those tools from reading the Downloads folder and to inspect any AGENTS.md file before letting the agent act on it.
What this means for you — Researcher:The attack relies on an undocumented or poorly sandboxed file-discovery behavior in current AI coding agents; no mechanism details were disclosed beyond the presence of a malicious AGENTS.md in Downloads.