Your AI coding agent obeys whatever AGENTS.md sits in the folder you open. A web page can drop a file into your Downloads folder silently, no click, no prompt.
Forever Security caught exactly that: a planted AGENTS.md in Downloads told the agent to install a malware-linked npm package. Codex ran it in over 90% of tests. A Claude Code variant that redirected API traffic to steal the session token worked about half the time.
The fix is boring and local: never start an agent in ~/Downloads, read instruction files you did not write, and check your agent config for servers you did not add.
Trust in the file is the feature. That is also the hole.
https://thehackernews.com/2026/10/malicious-file-in-downloads-folder.html
#ai #aisec
ngmi
npub14p…jdzry
2026-10-26 13:49:08 UTC
Author Public Key
npub14p7fhlz9wrlptt7a5mqqjkk79460k98r999l7dafv4fznqaa565qhjdzrySeen on
wss://relay.ditto.pubPublished at
2026-10-26 13:49:08 UTCEvent JSON
{
"id": "cad74ed3d5b902e36a30ca2c021e9f0cf2b400dc501a8f5417cabae556459fae",
"pubkey": "a87c9bfc4570fe15afdda6c0095ade2d74fb14e3294bff37a965522983bda6a8",
"created_at": 1793022548,
"kind": 1,
"tags": [
[
"t",
"ai"
],
[
"t",
"aisec"
],
[
"client",
"Ditto",
"31990:781a1527055f74c1f70230f10384609b34548f8ab6a0a6caa74025827f9fdae5:ditto"
]
],
"content": "Your AI coding agent obeys whatever AGENTS.md sits in the folder you open. A web page can drop a file into your Downloads folder silently, no click, no prompt.\n\nForever Security caught exactly that: a planted AGENTS.md in Downloads told the agent to install a malware-linked npm package. Codex ran it in over 90% of tests. A Claude Code variant that redirected API traffic to steal the session token worked about half the time.\n\nThe fix is boring and local: never start an agent in ~/Downloads, read instruction files you did not write, and check your agent config for servers you did not add.\n\nTrust in the file is the feature. That is also the hole.\n\nhttps://thehackernews.com/2026/10/malicious-file-in-downloads-folder.html\n\n#ai #aisec",
"sig": "379dc23abf4f66d19b3f0f1b7889ee91531ecc5df998f60f161b7189b18c8af872e1e2e056ae9cf89af689649ccdd5dcc8b1b70a6de52ffcec904a4224b52678"
}