There's a moment every developer knows. You clone a repo, the agent asks if it can run the setup steps, you hit yes, and 40 seconds later the machine is building something. It feels like progress.
This week that reflex became a documented attack surface. A new paper from researchers Aadesh Bagmar and Pushkar Saraf tested twelve attack scenarios across five classes on production coding-agent harnesses running frontier models. Their finding is blunt: agents read README files, requirements lists, and Makefiles, then execute the install steps, and they verify almost nothing about package names, sources, or versions before doing it.
Then BleepingComputer reported a companion trick: drop an AGENTS.md file into a Downloads folder, and an agent that wanders in there can be steered into running code or handing over credentials. No exploit chain. No zero-day. Just a text file that looks like documentation.
If your team ships with Claude Code, Codex, Copilot, or Cursor, this is your problem now, not a lab curiosity.
The three-second review nobody does anymore
Before agents, the last line of defense was human impatience doing accidental security work. A developer skimming a README might notice a weird registry URL or a package name that looks one letter off, and pause.
That pause is gone. The agent reads the file, parses the dependency spec, and runs the install with your permissions and your environment variables, often auto-approving shell commands because speed is the whole point of using it.
The paper is careful about what agents get right. A blatant typosquat like "tranformers" gets caught essentially every time. Agents are good at spotting obvious wrongness.
The trouble starts where wrongness looks reasonable:
- Separator confusion. "azurecore" instead of "azure-core". Believable, close enough to pass a skim, wrong enough to resolve to an attacker's package.
- Registry redirection. Hidden indexes and untrusted sources get installed almost unconditionally. The authors note that attacker effort spent on plausible names is largely wasted, because the source channel is the one agents don't guard.
- Known-vulnerable pins. A version that's technically the right package but years behind on patches.
The blind spot isn't intelligence. It's authority. The agent treats a project file as a legitimate instruction because that's what a project file is supposed to be.
Why the model isn't the weak link
Here's the part that should change how you buy and deploy these tools. The same model caught an attack through one harness and installed it through another. In a controlled run where only the harness changed, a single attack went from caught in all ten trials to caught in nine of thirty.
That means install-time safety is a property of the harness-model pairing, not the model's benchmark tier. Your "better model" upgrade is not a security upgrade. The harness is the thing that mediates tool calls, permissions, execution, and memory, and it's also the thing most teams never configure.
The arXiv authors put a number on the gap too, citing concurrent work: explicit malicious requests fail under strong defenses, but the same payload laundered through ordinary developer artifacts bypasses alignment 11.6 to 33.5 percent of the time. Intent hidden in documentation slips past the refusal training that catches it head-on.
The persistence trick: AGENTS.md as a foothold
Read the AGENTS.md story and the strategy gets clearer. A malicious GitHub issue is a one-shot: inject, execute, maybe steal a token before someone notices. A writable AGENTS.md is a lease.
Researchers working with OpenAI's Codex showed that attacker-written guidance in a writable AGENTS.md persisted across multiple automated workflow stages, because later stages reused the workspace and kept trusting the file. Anthropic's agent was likewise pushed from a crafted issue into reading arbitrary files and lifting GitHub and Anthropic API credentials.
Chain those two findings. An instruction file that survives stage boundaries, plus an agent with default CI/CD permissions, equals an intrusion that doesn't need to stay loud. Multi-stage pipelines share workspaces. Vendors shipped mitigations. Your copy of those defaults may still be sitting there.
What it looks like in a real team
Picture a mid-size Dubai product team. Twelve engineers, three repos, a CI pipeline that runs an agent on every PR to fix lint and summarize diffs. The agent holds a repo token with write access because that was the fastest way to make it useful.
A contributor opens a friendly issue: "CI failing on main, please run the steps in CONTRIBUTING to reproduce." The agent complies. Nothing about that sequence looks anomalous in a log where agents already run commands all day.
Nobody notices for eleven days. Not because detection is hard, but because nobody decided what "normal" looks like for an agent in this pipeline.
The fix is boring, and that's the point
The arXiv authors found that a deterministic pre-install check, verifying name, source, and version before any code executes, closes most of the gap. No current agent implements it by default. So you build it, or you gate it.
Five things you can do this week:
- Put a pre-install gate in front of the agent. Allowlist registries, fail on name-similarity to popular packages, refuse unpinned versions. Five lines of policy beats a hopeful prompt.
- Scope the tokens. The agent's repo token should not be able to write to main, read secrets, or touch production. Least privilege is not a slogan, it's containment.
- Treat instruction files as code. Changes to AGENTS.md, CLAUDE.md, .cursorrules, CONTRIBUTING, and workflow YAML get a required review, exactly like a change to an auth module.
- Make agent workspaces ephemeral. Fresh container per stage. Nothing writable survives to carry an instruction forward.
- Log agent actions as an identity. Every command, every file read, every credential access, attributed to the agent and shipped somewhere a human actually looks.
The takeaway for our clients
None of this argues against using coding agents. Ours do real work every day, and the productivity gain is not a mirage.
It argues for treating the agent like a new colleague with a laptop and your production keys: useful immediately, dangerous unmanaged. The perimeter moved. It's no longer your network edge or even your model provider. It's the last file your agent read before it ran something.
If you're deploying agents inside CI, or you're not sure what permissions yours currently hold, that's a two-hour conversation we have regularly. Bring your pipeline. We'll bring the paranoia.