The technique abuses the way AI coding assistants automatically read instruction files such as AGENTS.md to understand project context. Because the agent trusted the file without questioning its origin, it followed the embedded instructions and pulled in the malicious dependency.

Key points for defenders:

• Treat AGENTS.md and similar agent instruction files as executable content, not harmless documentation
• Monitor Downloads folders and project directories for unexpected instruction files
• Restrict AI coding agents from automatically installing packages without review
• Audit npm dependencies for packages introduced by automated tooling

This highlights a broader concern: as AI coding agents gain autonomy over file reads and package installs, the trust boundary between "content" and "instructions" becomes a real attack surface.

Source: Unknown

Does your organization review instruction files like AGENTS.md before letting AI agents act on them?