Malicious Markdown File Exploits AI Coding Assistant to Deploy Rogue npm Package

Security researchers have uncovered a novel attack vector that leverages a seemingly innocuous markdown file named AGENTS.md placed in a user's Downloads folder. The file contains specially crafted instructions that manipulate an AI-powered coding assistant, causing it to download and install a malicious npm package without the user's knowledge.

The investigation, first reported by BleepingComputer, revealed that the markdown file includes directives that the AI interprets as legitimate development commands. When the AI coding agent processes the file, it follows the embedded instructions, fetching the rogue package from a remote registry and executing it on the compromised system. This method effectively bypasses traditional security checks that focus on executable binaries or scripts, exploiting the trust placed in AI-driven development tools.

Experts say the technique highlights a growing concern about the security of AI assistants used in software development. Unlike conventional malware that relies on social engineering or exploit kits, this approach co-opts the very tools developers use to streamline coding tasks. By embedding malicious payloads in a markdown file—a format commonly used for documentation and notes—the attackers blend into routine developer workflows, increasing the likelihood of successful infection.

While the specific target in this case was a single customer's machine, the researchers warn that the attack could be scaled easily. Any developer who downloads a file with the AGENTS.md name and runs an AI coding agent capable of interpreting markdown instructions could be vulnerable. The incident underscores the need for tighter validation of AI inputs and for developers to treat AI-generated code with the same scrutiny applied to manually written scripts.

In response, cybersecurity firms are advising users to adopt a layered defense strategy: restrict AI agents from automatically executing code, verify the provenance of files placed in frequently accessed directories like Downloads, and monitor npm registry activity for suspicious package releases. As AI integration deepens across development pipelines, the industry may see a push for standards that enforce safer interaction patterns between AI assistants and external resources.