Zero Radar
← feed
HighSecurity incidentupdated 26 Oct 2026, 21:18 UTC

AI coding assistants can be tricked by hidden instructions in Markdown files

Attackers hide instructions inside ordinary text files that AI coding helpers read. The helper may follow those hidden instructions as if you had asked for them, possibly taking actions you did not intend.

Attacks reported (Dark Reading)1 source, unconfirmed
SeverityHighSecurity incident
Being exploited?ReportedBy Dark Reading, not officially confirmed yet
What to doCheck exposureDo not let an AI coding agent run in an untrusted project without reviewing its instruction files and requiring confirmation for actions.
How sure is this?1 source, unconfirmedOnly one publisher so far, details may change

How the attack works simplified

  1. 1Attacker plants fileHides instructions in a Markdown document
  2. 2Project includes fileInstruction file sits in the local project
  3. 3AI agent reads itCoding assistant loads local instructions as trusted
  4. 4Agent acts on textTreats injected text as executable commands
  5. ResultAssistant performs attacker-chosen actions

What happened

A prompt injection technique abuses how AI agents load local Markdown instruction files, treating text documents as executable directives. It is reported to be used in the wild.

Why it is dangerous: An attacker who can place or alter a file the assistant reads may cause it to take unwanted actions on a developer's machine or project. Developers who use AI coding agents on untrusted repositories are at risk.

Are you affected?

You are affected if you use an AI coding assistant or agent that automatically reads local Markdown instruction files from a project you did not fully vet.

What to do

  1. Review instruction and Markdown files in any repository before opening it with an AI coding agent
  2. Limit the actions your AI agent can take without confirmation, especially shell commands and file changes
  3. Check the vendor's documentation for updates or settings that restrict how local instruction files are trusted

Timeline

  1. 26 Oct 2026, 20:59 UTC
    Publicly disclosed
  2. 26 Oct 2026, 20:59 UTC
    Reported by Dark Reading · Dark Reading
  3. 26 Oct 2026, 21:18 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Security press established security newsrooms

Technical details

ID
ZR-c25a5812
Disclosed
26 Oct 2026, 20:59 UTC
On Zero Radar
26 Oct 2026, 21:18 UTC (19 min after disclosure)
Last change
26 Oct 2026, 21:18 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

AI coding assistants can be tricked by hidden instructions in Markdown files · Zero Radar