Attack in the wild turns markdown files into agent instructions

A prompt injection technique seen being used in the wild exploits the way AI coding assistants read local instruction files, according to a report published by Dark Reading on 26 October 2026. The outlet said the technique blurs the line between text documents and executable actions, so that content an agent was meant to simply read can end up shaping what it does.

Prompt injection is the term for hidden or unexpected instructions placed in content that a model reads, which the model then follows as though they came from its user. In this case the carrier is markdown, the lightweight formatting used for readme files, contributing guides and the project-level instruction files that modern coding agents pick up automatically when they open a repository. Those files exist precisely so an agent can learn a project's conventions without being told each time. Dark Reading's report describes how that trust is being turned against the agent.

The report characterises the attack as new and as occurring in the wild, rather than as a laboratory demonstration. That distinction matters for defenders: it suggests the behaviour is not confined to a researcher's test harness. Dark Reading did not, in the material reviewed for this article, name a specific vendor, product or victim, and no affected organisation has been identified. There is no public indication of how many projects or users have encountered the technique, nor of when the first abuse occurred. The incident is best treated as reported rather than confirmed in scope.

The underlying design problem is familiar to anyone who has followed agent security over the past two years. Coding agents are given broad permissions inside a developer's environment so they can be useful. They can read files, run commands and edit code. At the same time they ingest untrusted text from repositories, dependencies and documentation. A system that cannot reliably tell the difference between data it is reading and orders it has been given will eventually act on the wrong one. Markdown instruction files sit exactly on that boundary, because their entire purpose is to be documentation that the agent is supposed to obey.

For teams running coding agents, the practical questions raised by the report are about what those agents are allowed to do without a human in the loop, and whether instruction files pulled in from third-party or forked repositories are reviewed before an agent reads them. Dark Reading's account does not set out specific mitigations, and no vendor advisory has been tied to the technique in the source. Further detail will depend on vendors confirming whether their assistants are affected.