Agent config file (AGENTS.md/KNOWLEDGE.md) fetched from web and piped to shell

Ibrahim Saud@tektrix

•updated 11 days ago•6•0•3

Detects the suspicious retrieval and immediate execution of Agentic AI configuration files (e.g., AGENTS.md, KNOWLEDGE.md) from remote sources using common command-line utilities. This pattern is indicative of an adversary injecting malicious agent instructions or unauthorized configurations into an AI environment.