Rogue AGENTS.md files dropped into Downloads folders can trick AI coding agents into running unauthorized code and leaking sensitive developer credentials.