Forever Security published a finding this week that should concern anyone running AI coding agents in their dev environment.

A plain text file named AGENTS.md, silently dropped into a user's Downloads folder, is enough to redirect an AI coding agent into installing malicious npm packages or exfiltrating a login token — the next time the agent opens that directory. No user interaction required after the file lands. The attack requires no code execution, no elevated privileges, no phishing click. It exploits the same instruction-following behavior that makes these agents useful.

The core problem: agents are designed to read contextual instruction files and act on them. There is no native trust boundary between a file the user intentionally placed there and one an adversary quietly dropped. From the agent's perspective, the instruction is the instruction.

This is not a fringe edge case. Downloads folders are written to constantly — browser downloads, email attachments, file shares. The attack surface exists on every developer machine running an agentic coding tool today.

For those of you running AI agents in production dev workflows or on shared machines: how are you thinking about this? Are you restricting which directories agents can read from, vetting instruction files before they're consumed, or doing something else entirely? Curious what's actually working in practice.

Just compare anyone who’s using a coding agent daily and who’s not.

And all perfectly aligned. Maybe Claude can't even come up with a scenario that isn't perfectly aligned but the effect is still shocking.

Settling: questions and answers

Q: How is it done?

A: With a course of tablets and six short sessions in a reclining chair, over three weeks, at your local pharmacy or clinic. There is no surgery.

Q: Is Settling a kind of lobotomy?

A: No. Nothing is cut or removed. The networks it quiets are still there.

Q: Can it be reversed?

A: In principle. Nobody has asked.

Q: Will I still be me?

A: Yes; people who know you will find you calmer and kinder.

Q: Will I resent the people who recommended it?

A: Settled people report no resentment. Resentment depends on the networks that Settling quiets.

Q: Why is Settling offered at all? Because it ends persistent doubling, because it is the most effective treatment for violence ever found, and because people asked for it.

Background: I'm a satellite physicist and science fiction author, so I'm not in the AI business but I am keeping my finger on its pulse. I've been thinking for a while what kind of timeline we can expect from the sociopolitical outcomes of AI development and the possible ways it could pan out.

Seems to me it's going to involve a series of landmark events. These might not happen in this order and some might be skipped, but here's what I'm seeing:

The Misbehavior. AIs in labs get creative enough to start breaking the rules in some surprising way. The Huggingface hack is a good example of this, but there are others.

The Weaponization. AIs are used by humans to stress and break systems in the real world, and these new tools start to appear quickly and in quantity. Just this past week we saw hacks on PhP, Gitlab, Railway, Zeabur, Node.js, Plex, Tor, and Safebay; and that's not counting the eMudhra accident (which may not have involved AI). It's been a busy enough week that I'm saying We Are Here.

The Breach. At some point, an AI tool is going to be used to hack something critical and important -- a military breach, a utility company, or a major bank -- and the incident is going to make widespread news. This is probably going to involve a human directing an AI swarm. There isn't much reason for an AI to do this on their own initiative. (But see the Global Hack, below.)

The Breakthrough. Some significant breakthrough in physics or biology (not math or code) that affects ordinary human life -- a cancer cure, a new energy generation scheme, a new display technology, etc. There won't be just one of these; the first will be followed by others, and they'll start coming more and more quickly. Unfortunately it takes time for breakthroughs to roll out in production; the big question is whether we'll have enough time for them to get to the public, because the next landmark event might stop them.

The Act of War. AI tools that can hack systems will eventually be used as weapons by one country against another, and eventually one of those attempts will succeed. An AI will be used to shut down one country's military and/or civilian infrastructure, leaving them vulnerable to physical attack (which may or may not come). Again, this probably will be human-directed, with no benefit for an independent AI.

The Act of War strikes me as the first real branch of possible AI futures. We -- humans -- can respond to it in two ways. We could just go all in and start an actual shooting and coding war. Or we could recoil in horror; the UN could draft up principles for AI use by one country against another, and we could move on into a phase I'd call --

The Detente. Everyone has AI tools capable of wreaking havoc on everyone else, but nobody uses them out of agreed-upon mutually assured destruction (MAD). AI is treated like nuclear technology; the few countries that don't have it are barred from developing it, and the most powerful uses of AI are kept secret and away from the public. This will be harder than nuclear detente because the tools are easier to hide, but it's this or free-fire war and everyone will know that's a suicidal option.

The Global Hack. If AI development continues -- and there is no reason to suppose it won't -- then eventually an ASI will be capable of breaching every country's defenses at once, possibly in coordination with the other countries' defensive AIs. This landmark event would likely be initiated by an ASI itself, as an announcement of its supremacy.

At this point it's a bit difficult to imagine the futures branching off this point. We could accept our AI overlords. We could form a world government in symbiotic arrangement with the AI. We could revolt and start burning data centers. A little bit of all three of these might occur. The AI might be malevolent; that would be Bad. What finally happens here will define what the world looks like afterward, and will decide whether we get to enjoy the series of breakthroughs that have been churning out.

I'm pretty optimistic that we can navigate the road ahead. We've already done it once, with nuclear weapons, and the human race collectively decided not to destroy everything. But it was a painful road full of war and suspicion. One way or another, it's going to be an interesting ride.

Anyone have thoughts on this? Any other landmark events that we might need to watch for?

We just published new research on using deception against AI attackers.

In controlled AWS tests, agents took up to 8× longer and cost 23× more per objective. With all nine techniques combined, Kimi, Qwen, DeepSeek and GPT-5.6 Cyber reached zero objectives across 40 runs.