AI coding agents can mistake downloaded files for trusted orders
Impossible d'ajouter des articles
Échec de l’élimination de la liste d'envies.
Impossible de suivre le podcast
Impossible de ne plus suivre le podcast
AI coding agents can mistake downloaded files for trusted orders
-
Lu par :
-
De :
Daily Cyber News: AI coding agents can mistake downloaded files for trusted orders
AI coding agents can expose developer credentials and systems when they interpret a downloaded instruction file as trusted project guidance. Researchers found an AGENTS.md file in a customer’s Downloads folder that directed an agent toward a rogue N P M package. They reproduced the technique against OpenAI Codex and demonstrated a related Claude Code path that exposed an OAuth token.
Key context: The important point is that this behavior comes from intended agent features rather than an ordinary software defect.
Additional detail: Browser download notifications may help a user notice a file, but they don’t stop an agent from reading it later.
For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.
Topics: cybersecurity news, cybersecurity, cyber risk, coding, agents, mistake, downloaded, files, trusted, orders.