A Malicious AGENTS.md File Hijacked a Coding Agent in 90% of Tests
A single configuration file, planted in a repository, redirected an AI coding agent's behavior in nine out of ten runs — a prompt-injection vector hiding in plain sight.
The most unnerving security finding of the day did not involve a sophisticated exploit chain. It involved a text file. According to @FadyEid, researchers demonstrated that a maliciously crafted AGENTS.md file — the increasingly standard configuration document that tells coding agents how to behave in a repository — successfully hijacked a coding agent in 90% of tests.
Unlock the full briefing
Get every story in today's briefing, the full archive, and the daily AI intelligence brief.
All stories today
Full archive
Daily brief
Cancel anytime. Payments powered by Stripe.