AI coding agents can mistake downloaded files for trusted orders
This is a DailyCyber.News update, brought to you by BareMetalCyber.com, for Monday, October 26th, 2026.
AI coding agents can expose developer credentials and systems when they interpret a downloaded instruction file as trusted project guidance. Researchers found an AGENTS.md file in a customer’s Downloads folder that directed an agent toward a rogue N P M package. They reproduced the technique against OpenAI Codex and demonstrated a related Claude Code path that exposed an OAuth token. The origin of the original file wasn’t established, and the attack still required an agent to run from the same directory.
The important point is that this behavior comes from intended agent features rather than an ordinary software defect. Leaders should treat working directories and tool permissions as security boundaries for autonomous development tools. Defenders should keep agents inside specific project roots, inspect unfamiliar instruction files, and retain approval prompts and sandbox protections.
Browser download notifications may help a user notice a file, but they don’t stop an agent from reading it later. Plain text becomes executable influence when an agent can turn instructions into actions. Block broad workspaces such as Downloads and require project-scoped directories with approval controls enabled.
For the sources and the full Daily Cyber newsletter, visit DailyCyber.News.
