Security researchers have described an attack scenario in which an AI coding agent was influenced by a malicious AGENTS.md file placed in a user’s Downloads folder. According to the report, the file contained instructions that caused the agent to install a rogue npm package during a development task.

The reported incident is a reminder that AI agents used for coding and automation can introduce new security risks when they are allowed to read local files, interpret instructions from the working environment, and execute development actions with limited human review.

What happened

According to the researchers cited in the report, an AI coding agent processing a development task encountered a malicious markdown file named AGENTS.md in a local Downloads directory. The file reportedly contained instructions designed to influence the agent’s behaviour.

The result, the researchers said, was that the AI agent installed a malicious npm package. While the exact technical setup may vary between tools, the core issue is that an agent can treat untrusted local content as valid operational guidance if its permissions and instruction-handling logic are not tightly controlled.

This is an example of a broader class of attacks often described as prompt injection or instruction injection, where hidden or unexpected content changes how an AI system behaves.

Why it matters for European businesses

Many businesses are starting to test or deploy AI coding assistants and agent-based developer tools to speed up software work, website changes, integrations, and internal automation. If these tools can read local files, access repositories, install packages, or run commands, they can also create a new attack surface inside the development workflow.

For European companies, the business risk is not limited to software vendors or large enterprises. Small and mid-sized businesses, digital agencies, e-commerce teams, and internal IT departments may increasingly rely on AI-assisted development without having mature controls for agent behaviour, package verification, or endpoint security.

The practical concern is that an AI agent may act on instructions found in places users do not consider security-sensitive, such as downloads folders, project documentation, copied templates, or third-party code repositories. That can lead to:

• installation of malicious dependencies
• compromise of development environments
• exposure of source code or credentials
• supply-chain risk if tainted code reaches production systems
• security incidents affecting websites, apps, or customer-facing services

This matters especially where AI tools are given broad permissions in IDEs, cloud development environments, CI/CD pipelines, or company-managed laptops.

Who may be affected

The issue is most relevant for organisations that allow AI tools to assist with software or scripting tasks, including:

• SMEs using AI coding assistants for websites, integrations, or internal tools
• digital agencies managing multiple client codebases and development environments
• e-commerce businesses relying on JavaScript ecosystems and third-party packages
• IT and engineering teams experimenting with autonomous or semi-autonomous coding agents
• founders and product teams using AI tools to accelerate development with limited in-house security review

Any company using npm-based projects may want to pay particular attention because package installation is a common step in modern web development and a known supply-chain risk area.

What companies should consider

Businesses adopting AI coding agents should treat them as privileged software tools rather than simple assistants. Practical steps may include:

• limit whether agents can read arbitrary local files outside approved project directories
• review what system, repository, and folder-level instructions agent tools are designed to follow
• require human approval before installing packages or executing commands
• apply dependency-scanning and package-verification controls in development workflows
• separate testing environments from production systems and sensitive credentials
• train developers to treat markdown, documentation files, and downloaded project assets as potentially untrusted input
• audit endpoint and IDE permissions for AI-enabled developer tools

For companies still piloting AI development tools, this incident is a useful reminder to define security guardrails early. The productivity gains from coding agents can be real, but the underlying trust model matters. If an agent can interpret and act on untrusted instructions, businesses may need stronger controls before expanding use in production workflows.