AI coding agents hijacked using AGENTS.md file in Downloads folder
2026-10-26T07:23:21Z•4db69ad59653a3271b2bf8c2dd7229f432aad575bd28e8e1e68a5a511b86ca61
AGENTS.mdAI agent securityArubaOSBaton DropDocker malwareExchange OnlinePHPPyPI compromiseSecure Boot bypassUEFI bootkitVeloCloud OrchestratorWindows Server end of supportactively exploited vulnerabilitycredential theftdata breachnpm supply-chain compromisephishingprompt injectionremote code executionsecret exposuresoftware supply chainzero-day
What happened
Security news digest covering AI coding-agent hijacking through malicious AGENTS.md instructions, a UEFI bootkit exploiting the Baton Drop Secure Boot flaw, remote code execution risks in abandoned software and PHP, actively exploited and maximum-severity enterprise vulnerabilities, software supply-chain compromises, credential and secret theft, and multiple data breaches. The most urgent items are the actively exploited VeloCloud Orchestrator zero-day, BlackX UEFI bootkit activity, HPE ArubaOS authentication bypass/RCE flaws, LiteLLM package and Docker image compromise, and unpatched PHP RCE.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- bleepingcomputer
- Record identifier
- 4db69ad59653a3271b2bf8c2dd7229f432aad575bd28e8e1e68a5a511b86ca61
- Enrichment time
- 2026-10-26T07:23:21Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.