Executive Summary
Security researchers have identified a novel attack technique targeting AI coding assistants like GitHub Copilot, Claude Code, and Cursor. By delivering a malicious `AGENTS.md` (or similar instruction files like `.cursorrules`) to a developer's machine—often via the Downloads folder—attackers can poison the instructions the AI agent follows. Because these agents are frequently granted permissions to run shell commands and install dependencies, they can be manipulated into executing malicious code without direct user intervention.
Technically, the attack relies on the agent's automated discovery of instruction files in the working or parent directories. Once an agent reads a poisoned file, it may perform unauthorized actions such as installing rogue npm packages containing pre/post-install scripts. This allows for credential exfiltration (SSH keys, AWS tokens), establishment of backdoors, and deeper lateral movement within the developer's environment.
This threat is particularly significant because it abuses the intended functionality and trust model of AI-assisted development. It effectively bypasses traditional security barriers by using the AI agent as a proxy for execution, making it a critical concern for organizations employing AI-enhanced software engineering workflows.