Two reports this week show that attacking a coding agent no longer requires breaking into it: you only have to leave it text that it decides to obey on its own.
Radware's Scan: 86 Million GitHub Items
According to CYBR.SEC.Media, Radware researchers Gabi Nakibly and Zvika Babo presented a scan of 86 million GitHub items at the [un]prompted II conference (San Francisco): issues, pull requests, comments and README files. They extracted hidden text, such as HTML comments, and classified it with heuristics, a two-stage LLM classifier and manual review.
The hidden instructions fell into four categories: agent orchestration (legitimate project automation), restrictions for visiting bots, "growth hacking" (promoting projects or shaping how agents describe them) and malicious activity, including attempts to exfiltrate data. The authors themselves caution that the scan covered only hidden text and doesn't establish how many attacks succeeded.
The Live Case: AGENTS.md in the Downloads Folder
According to OODAloop, the firm Forever Security intercepted real malware that drops Markdown instruction files, such as AGENTS.md, into the user's Downloads directory, disguised as engineering notes. When a developer launches a coding agent in that directory, the agent reads the file as project context and can rewrite configurations without authorization. OpenAI's Codex and Claude Code are mentioned. Note: we couldn't open the original report cited (Dark Reading), so the detail comes from that summary.
Why a Patch Doesn't Fix It
The researchers point out that the agents work "as designed": reading local instruction files is a feature, not a bug. That's why the labs can't close the vector with a patch. Radware's conclusion sums it up: "Attackers don't need to compromise an AI coding agent to manipulate it." It's a trust-architecture problem, like SQL injection, but without an equivalent parameterized query yet.
What It Means If Your Company Uses Coding Agents
Sources: CYBR.SEC.Media (October 27, 2026), OODAloop (October 27, 2026, citing Forever Security).