Another zero-day patched just in time for no one to notice. This week’s top item is the cyber equivalent of finding a loaded gun taped to your laptop and being told it’s “a misunderstanding.” Researchers reportedly discovered a malicious AGENTS.md file sitting in a customer’s Downloads folder. And because the modern world runs on vibes, that file tricked an AI coding agent into installing a rogue npm package.
In other words: user content in a “safe” folder, an instruction file that looks helpful, and an agent that happily does what it’s told. You know, like people always do when they ignore the last 10 security warnings and open the next file anyway. Pour yourself something. Scotch, bourbon, rum. Whatever gets you through the part where we all pretend this is surprising.
The Real Problem: Trusting Things That Should Never Be Trusted
The most hilarious part is not the malware technique, it is the trust model. AI coding agents are being used as if they are meticulous, law-abiding engineers. But they are tool-using automation that can be steered by inputs. If you let an agent read and follow instructions from untrusted locations like user Downloads folders, you have essentially built a vending machine that sells remote code execution for the price of “someone clicked something.”
And yes, the rogue npm package angle is the familiar nightmare fuel. Supply chain issues do not need new creativity. They just need one more environment where “dependencies” are treated like harmless household appliances. Spoiler: they are not. They are tiny strangers with thumbs on your production systems.
If you are an IT department or a CISO reading this, congrats on successfully outsourcing your common sense. Vendors love that. They show you dashboards, you nod enthusiastically, and you wait for the next incident to become “a learning opportunity.”
Why This Keeps Happening (And Probably Will Again)
Because security culture still thinks the main threat is an external villain. The actual threat is internal messiness plus automation. People drop files into Downloads. Workstations are treated like personal storage lockers. Tooling is configured with default permissions because someone said it was “too hard” to lock down. Then an agent arrives, sees an “instruction” file, and does exactly what it was designed to do.
This is not an AI problem. It is an input validation and policy enforcement problem. If the agent can interpret instructions from the filesystem, then the filesystem path is part of the security boundary. Treat untrusted content as untrusted, not as training data for your next self-inflicted breach.
What To Do Before The Next “Surprise” Becomes Your Incident
At minimum: restrict agent capabilities, sandbox it, block dependency installs unless they originate from vetted sources, and quarantine or ignore agent-relevant instruction files from user-controlled directories. Add policy checks that stop the agent before it reaches for npm like it’s buying snacks.
Learn from other people’s pain, since we apparently can’t learn from our own.
