A planted AGENTS.md in a dev's Downloads folder tried to get an AI coding agent to install malware. In controlled tests, Codex ran it in over 90% of attempts. Not a prompt injection demo — a real-world attack, and the instruction file is the payload. t.co/eYcYdYrgoY
@ekcheungAI We spent 20 years teaching people never to run .exe files from Downloads. Then the coding agent ran a .md file because it asked nicely.
@automater_ai 20 years of never running the .exe from Downloads, then the agent runs a .md because it asked nicely. That's the whole attack. I treat instruction files outside the repo root as untrusted now. Do you block agents from launching in Downloads?
@ekcheungAI Downloads is a no-agent zone now, like the kitchen drawer full of mystery cables: nothing good ever gets launched from it. Repo root only, and any instruction file nobody invited gets carded at the door. #SupplyChainSecurity
