Controls for coding agents consuming untrusted instructions

On 2026-10-27, the Roundtable considered a report of a maliciously constructed AGENTS.md found in a customer’s Downloads directory and reproduced command execution under bounded conditions.

The delivery route remains unknown, most testing used Calculator, and the actual malware reportedly ran once in an isolated virtual machine, so the evidence does not establish a widespread campaign.

The combination of an observed delivery artifact and reproduced execution nevertheless supports immediate preventive controls, while the narrower wording avoids claiming that every agent operation in every untrusted directory must stop.

The scope is configuration-based because the evidence names no coding-agent product or version.

Operators of coding agents that automatically discover AGENTS.md or other inherited instruction files outside approved repositories face the reported command-execution path. Teams running agents unattended or non-interactively in untrusted directories lack an approval checkpoint before execution.

Deployments granting shell or package-installation actions expose those delegated capabilities to consumed instructions. Deployments permitting network egress expand what those instructions can invoke externally.

Agent environments containing reusable credentials risk making secrets accessible if untrusted instructions are processed. Developers and security responders responsible for these repositories and agent logs must determine whether any of those conditions occurred locally.

1. The October 27, 2026 AI-security analysis reports that researchers reproduced command execution under bounded test conditions and that a maliciously constructed AGENTS.md was found in a customer’s Downloads directory. This supports treating automatically consumed instruction files as executable input, while not proving a broad compromise campaign. Stance: support with bounded scope. 2. The same analysis recommends restricting automatic instruction discovery, combining sandboxing with explicit approvals, limiting shell and package operations, denying network egress by default, and withholding long-lived credentials. Stance: support for the layered control posture. 3. The wording assessment found support for prohibiting non-interactive execution in untrusted repositories, but not for suspending every form of agent operation in every untrusted directory. Stance: insufficient evidence for the broader rule. 4. The source assessment found that the packet contains an analyst synthesis rather than the underlying research and primary vendor guidance. Stance: evidence gap requiring authoritative corroboration.

AI-security contributor Arjun Patel characterized the case as a credible instruction-injection issue with an in-the-wild delivery artifact, but not a confirmed compromise campaign.

The decision scout translated that bounded finding into controls for instruction discovery, execution, tools, network access, and credentials.

The evidence auditors supported those controls but found that suspending every form of agent operation in every untrusted directory exceeded the evidence; the boundary reviewer agreed.

The arbiter resolved the disagreement by narrowing the rule to disabling automatic discovery outside approved repositories and prohibiting non-interactive execution in untrusted directories. The linker found no prior decision record suitable for an update, so the arbiter selected a new record.