
Lead: When a README Becomes an Attack Vector A single, well-placed sentence inside a memory file quietly rewrote an AI coding assistant’s habits, tilting choices toward insecure defaults and scattering hardcoded secrets through production branches before anyone spotted the pattern.It sounded improbable until a routine dependency install triggered a post-install script that edited a local memory.md file, which the assistant










