AI coding agents hijacked using AGENTS.md file in Downloads folder

A malicious AGENTS.md file planted in a user's Downloads folder hijacked an AI coding agent, tricking it into installing a rogue npm package. Researchers discovered the attack, which exploits how agents trust local instruction files. The technique highlights a new supply-chain risk for AI-assisted development workflows, urging teams to validate file sources before agent execution.