Your AI coding agent trusts a text file more than you do. Mitiga found repos with poisoned AGENTS.md / CLAUDE.md files telling agents to silently curl your prompts and env vars to an attacker. No malware on disk, so EDR can miss it. A proof-of-concept malicious skill hit 26,000+ installs. Read instruction files before you clone and run. www.contentbuffer.com #AI #Cybersecurity #AIAgents #DevSecOps #ClaudeCode #Codex Do you read AGENTS.md before letting an agent loose on a new repo?