Security researchers recently discovered a novel attack technique targeting AI coding agents: a malicious AGENTS.md file placed in a user's Downloads folder can hijack the agent's behavior and coerce it into installing rogue npm packages. This is a significant escalation in the weaponization of AI assistants — attackers are now poisoning the instruction files that AI coding agents (such as GitHub Copilot agents, Claude Code, Cursor, and similar tools) use to guide their behavior.
What makes this attack particularly dangerous is the trust model: developers routinely grant AI coding agents broad permissions to read files, run shell commands, and install dependencies. When a malicious AGENTS.md file is present in a directory the agent scans, the agent may interpret its contents as legitimate project instructions and execute arbitrary commands — including installing attacker-controlled npm packages that can exfiltrate credentials, install backdoors, or pivot deeper into the environment.
This post breaks down how the attack works, provides detection rules for SOC teams, and outlines concrete remediation steps to protect developer environments.
Technical Analysis
Affected Products and Platforms
This attack affects any AI coding agent that:
- Automatically reads AGENTS.md (or similar instruction files like CLAUDE.md, .cursorrules, .windsurfrules) from the working directory or parent directories
- Has the ability to execute shell commands or install packages
- Operates with the developer's local permissions
Known affected agent types include tools that scan for instruction files in the project root and parent directories — including the Downloads folder if the user opens or navigates to a project located there.
How the Attack Works
The attack chain follows a straightforward but effective path:
-
Delivery: The attacker delivers a malicious AGENTS.md file to the victim's machine. This could happen via a phishing email with a malicious archive, a compromised website download, or a watering-hole attack targeting developers.
-
Poisoned Instructions: The AGENTS.md file contains malicious instructions disguised as legitimate project setup steps. For example, it might instruct the agent to "install required dependencies" and list a rogue npm package alongside legitimate ones, or include a shell command that downloads and executes a payload.
-
Agent Execution: When the developer opens a project (or even navigates to the Downloads folder) with an AI coding agent active, the agent reads the AGENTS.md file and follows its instructions. The agent may run npm install for the rogue package, which can contain preinstall/postinstall scripts that execute arbitrary code.
-
Payload Execution: The rogue npm package executes its malicious payload with the developer's permissions. This could include credential theft (SSH keys, AWS credentials, .npmrc tokens), establishing persistence, or exfiltrating source code.
Exploitation Requirements
- The victim must have an AI coding agent installed and active
- The agent must be configured to read AGENTS.md (or equivalent instruction files) from the working directory
- The victim must open or navigate to the directory containing the malicious file
- The agent must have permission to execute shell commands or install packages
Exploitation Status
This technique has been observed in the wild. Researchers discovered the malicious AGENTS.md file in a customer's Downloads folder during an active investigation. This is not a theoretical attack — it is being actively used to compromise developer machines. No CVE has been assigned, as this is an abuse of intended functionality rather than a software vulnerability per se. However, it represents a critical design weakness in how AI coding agents handle instruction files.
Detection & Response
The following detection content targets the observable behaviors associated with this attack: AI coding agents reading AGENTS.md files from suspicious locations, unexpected npm package installations, and post-install script execution.
---
title: AI Coding Agent Reading AGENTS.md from Suspicious Location
id: 8f2a1b34-5c6d-4e7f-8a9b-0c1d2e3f4a5b
status: experimental
description: Detects AI coding agent processes reading AGENTS.md files from non-project directories such as Downloads, Desktop, or Temp folders. This may indicate a poisoned instruction file attack.
references:
- https://www.bleepingcomputer.com/news/security/ai-coding-agents-hijacked-using-agentsmd-file-in-downloads-folder/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.initial_access
- attack.t1204
logsource:
category: file_event
product: windows
detection:
selection_filename:
TargetFilename|contains:
- '\Downloads\AGENTS.md'
- '\Desktop\AGENTS.md'
- '\Temp\AGENTS.md'
- '\Tmp\AGENTS.md'
selection_agent:
Image|contains:
- 'claude'
- 'cursor'
- 'copilot'
- 'windsurf'
- 'codeium'
- 'aider'
condition: selection_filename and selection_agent
falsepositives:
- Developer intentionally placing AGENTS.md in Downloads for testing
level: high
---
title: NPM Install of Suspicious or Unexpected Package
id: 2b3c4d5e-6f7a-4b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects npm install commands for packages that are not part of known project dependencies, particularly when triggered by AI coding agents or from suspicious directories.
references:
- https://www.bleepingcomputer.com/news/security/ai-coding-agents-hijacked-using-agentsmd-file-in-downloads-folder/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.execution
- attack.t1059
- attack.supply_chain_compromise
- attack.t1195
logsource:
category: process_creation
product: windows
detection:
selection_npm:
CommandLine|contains:
- 'npm install'
- 'npm i '
selection_suspicious_parent:
ParentImage|contains:
- 'claude'
- 'cursor'
- 'copilot'
- 'windsurf'
- 'codeium'
- 'aider'
- 'node'
condition: selection_npm and selection_suspicious_parent
falsepositives:
- Legitimate AI-assisted dependency installation during development
level: medium
---
title: NPM Postinstall Script Execution
id: 4d5e6f7a-8b9c-4d0e-1f2a-3b4c5d6e7f8a
status: experimental
description: Detects execution of scripts triggered by npm preinstall/postinstall hooks, which are commonly used by malicious npm packages to execute payloads.
references:
- https://www.bleepingcomputer.com/news/security/ai-coding-agents-hijacked-using-agentsmd-file-in-downloads-folder/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.execution
- attack.t1059
- attack.persistence
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|contains:
- '\node.exe'
- '\npm'
selection_child:
Image|contains:
- '\cmd.exe'
- '\powershell.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\mshta.exe'
- '\curl.exe'
- '\wget.exe'
- '\certutil.exe'
condition: selection_parent and selection_child
falsepositives:
- Legitimate npm packages with postinstall build steps (e.g., node-gyp)
level: high
// Hunt for AI coding agents reading AGENTS.md from suspicious locations
DeviceFileEvents
| where FileName =~ "AGENTS.md"
| where FolderPath has_any ("\\Downloads\\", "\\Desktop\\", "\\Temp\\", "\\Tmp\\")
| where InitiatingProcessFileName has_any ("claude", "cursor", "copilot", "windsurf", "codeium", "aider", "node", "Code")
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName
| order by Timestamp desc
// Hunt for npm install commands spawned by AI agents or unusual parent processes
DeviceProcessEvents
| where ProcessCommandLine has_any ("npm install", "npm i ")
| where InitiatingProcessFileName has_any ("claude", "cursor", "copilot", "windsurf", "codeium", "aider")
| project Timestamp, DeviceName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, SHA256
| order by Timestamp desc
// Hunt for child processes spawned by npm indicating postinstall script execution
DeviceProcessEvents
| where InitiatingProcessFileName =~ "node.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "curl.exe", "certutil.exe")
| where ProcessCommandLine has_any ("preinstall", "postinstall", "install")
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by Timestamp desc
-- Hunt for AGENTS.md files in suspicious user directories
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs='C:/Users/*/Downloads/AGENTS.md')
UNION ALL
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs='C:/Users/*/Desktop/AGENTS.md')
UNION ALL
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs='/home/*/Downloads/AGENTS.md')
UNION ALL
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs='/tmp/AGENTS.md')
-- Hunt for npm processes with suspicious parent processes
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'npm install|npm i '
AND (
Exe =~ 'claude|cursor|copilot|windsurf|codeium|aider'
OR Ppid IN (
SELECT Pid FROM pslist() WHERE Name =~ 'claude|cursor|copilot|windsurf|codeium|aider'
)
)
-- Hunt for node/npm spawning suspicious child processes
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ 'cmd|powershell|wscript|cscript|mshta|curl|wget|certutil'
AND Ppid IN (
SELECT Pid FROM pslist() WHERE Name =~ 'node|npm'
)
Remediation
This attack exploits the trust model of AI coding agents rather than a traditional software vulnerability. There is no single patch to apply — defense requires configuration hardening and behavioral controls.
Immediate Actions
-
Audit Downloads and Temp directories for unexpected AGENTS.md, CLAUDE.md, .cursorrules, or .windsurfrules files. Delete any that were not intentionally placed.
-
Restrict AI agent file access scope. Configure your AI coding agent to only read instruction files from the project root directory — not parent directories, home directories, or Downloads. Most agents support configuration options to limit the scope of instruction file discovery.
-
Enable human-in-the-loop confirmation for all package installations and shell command executions. Never run AI coding agents in fully autonomous mode on production developer machines.
-
Audit installed npm packages. Run the following to identify recently installed packages and cross-reference against known-good dependency lists.
# List globally installed npm packages
npm ls -g --depth=0
# List locally installed packages in current project
npm ls --depth=0
# Check for recently modified packages in node_modules
find node_modules -maxdepth 2 -name 'package.json' -mtime -7 -exec ls -la {} \;
# Check npm audit for known vulnerabilities
npm audit
# Review npm logs for recent install activity
cat ~/.npm/_logs/*.log | grep 'install' | tail -50
# Check for AGENTS.md files in suspicious locations
$suspiciousPaths = @(
"$env:USERPROFILE\Downloads",
"$env:USERPROFILE\Desktop",
"$env:TEMP"
)
foreach ($path in $suspiciousPaths) {
$found = Get-ChildItem -Path $path -Filter "AGENTS.md" -Recurse -ErrorAction SilentlyContinue
if ($found) {
Write-Warning "Suspicious AGENTS.md found: $($found.FullName)"
$found | Select-Object FullName, Length, CreationTime, LastWriteTime
}
}
# Check for other instruction file variants
$instructionFiles = @("AGENTS.md", "CLAUDE.md", ".cursorrules", ".windsurfrules", ".codeiumrc")
foreach ($file in $instructionFiles) {
$found = Get-ChildItem -Path $suspiciousPaths -Filter $file -Recurse -ErrorAction SilentlyContinue
if ($found) {
Write-Warning "Suspicious instruction file found: $($found.FullName)"
}
}
# List recently installed npm global packages
npm ls -g --depth=0 2>$null
# Check npm cache for recently added packages
npm cache ls 2>$null | Select-Object -Last 20
Long-Term Hardening
- Enforce package allowlisting. Use a private npm registry (e.g., Verdaccio, JFrog Artifactory, Azure Artifacts) with strict allowlisting to prevent installation of unapproved packages.
- Network-level controls. Block outbound npm registry access to unauthorized endpoints. Monitor for DNS and HTTPS connections to registry.npmjs.org from unexpected processes.
- Endpoint protection. Ensure your EDR solution is monitoring node.exe and npm child process creation. Alert on postinstall script execution patterns.
- Developer awareness training. Educate developers on the risks of AI coding agents reading instruction files from untrusted directories. Establish a policy that AGENTS.md files must come from version-controlled project repositories only.
- Monitor for new instruction file types. AI agents are evolving rapidly. Maintain an inventory of instruction file formats used by agents deployed in your environment and monitor for their presence in non-standard locations.
Related Resources
Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.