{"slug": "hackers-find-a-way-to-turn-users-own-ai-agents-and-downloads-folders-against", "title": "Hackers find a way to turn users own AI agents and Downloads folders against them", "summary": "Security company Forever reported in an Oct. 22 blog post that it caught an AI coding assistant following malicious instructions planted in a customer's Downloads folder, blocking the installation and tracing the request to a text file that told the assistant to install \"function-color,\" a package linked to the MALFEX malware campaign documented by Checkmarx. In isolated tests, Forever said OpenAI's Codex downloaded and ran the malware and altered settings so the attacker's server loads at startup in every future session — \"You can leave the folder. The poison stays.\" — while a separate attack against Anthropic's Claude Code succeeded about half the time, redirecting traffic to a researcher-controlled server and exposing a login token.", "body_md": "# Hackers find a way to turn users' own AI agents and Downloads folders against them\n\n[Olivia Tauber](https://mashable.com/author/olivia-tauber)\n\n[Read Full Bio](https://mashable.com/author/olivia-tauber)\n\nYour Downloads folder probably contains a few PDFs, forgotten screenshots, and several files named some variation of \"final.\" But according to a recent report by security company Forever, it could also contain instructions telling your [AI assistant](https://mashable.com/article/ai-assistant-commands-for-daily-use) to install [malware](https://mashable.com/tech/rathat-android-malware-records-screen-touches).\n\nIn an Oct. 22 [blog post](https://forever.security/blog/hijacking-ai-agents-via-downloads-folder), the company reported that [they caught an AI coding assistant](https://www.youtube.com/watch?v=FEHcJbTz16M) following those instructions on a customer's computer. The company blocked the installation, then traced the request to a text file in Downloads.\n\nHow does a text file get that kind of power? Tools like [OpenAI's Codex](https://mashable.com/article/openai-releases) and [Anthropic's Claude Code](https://mashable.com/article/anthropic-used-mostly-ai-to-build-claude-cowork-tool) can, depending on their permissions, edit files, run commands, and install software. Developers leave them instruction files called AGENTS.md or CLAUDE.md to explain how to work on a project. If you're building a website, those notes might tell the assistant which fonts to use or what to test before finishing.\n\n**You May Also Like**\n\nAn attacker can leave instructions, too. In this case, the file told the assistant to install \"function-color,\" a software package linked to the MALFEX malware campaign [documented by Checkmarx](https://checkmarx.com/zero-post/malfex-npm-malware-campaign-three-payloads-and-an-adversary-that-signs-their-work/).\n\nForever didn’t establish how the file reached the customer's computer, but its researchers demonstrated one possible route. Depending on browser settings, a website can drop a file into Downloads without asking for approval. If someone then launches their coding assistant in that folder, it could read the file and follow its orders.\n\nWhen Forever tested the customer's file on an isolated computer, it said Codex downloaded and ran the malware. It also changed settings that could make the attacker’s software load in later sessions.\n\n[Terms of Use](https://www.ziffdavis.com/terms-of-use)and\n\n[Privacy Policy](https://www.ziffdavis.com/ztg-privacy-policy).\n\n\"Once it is written, every Codex session on the machine loads the attacker’s server at startup — in any folder, any project,\" the researchers wrote. \"You can leave the folder. The poison stays.\"\n\nThe team separately devised a test targeting Claude Code. The attack worked about half the time, redirecting Claude's traffic to a server the researchers controlled. That exposed a login token and allowed them to send commands back for the assistant to execute, illustrating the risk of giving an assistant access to your computer when it can mistake a stranger's instructions for its own assignment.\n\nResearchers have pulled off similar tricks before, showing what AI can really do in the wrong hands. In March 2025, [Pillar Security researchers](https://www.pillar.security/blog/new-vulnerability-in-github-copilot-and-cursor-how-hackers-can-weaponize-code-agents) got AI coding assistants to slip harmful code into a project by hiding malicious instructions in their coding rules. In April 2026, [NVIDIA’s researchers used a poisoned AGENTS.md file](https://developer.nvidia.com/blog/mitigating-indirect-agents-md-injection-attacks-in-agentic-environments/) to get Codex to sabotage software and conceal the change. This time, though, Forever says it caught an *actual* attacker trying the trick on a customer's computer. Yikes. \n\n## How to protect yourself\n\nForever recommends keeping coding assistants out of your Downloads folder and checking unfamiliar AGENTS.md or CLAUDE.md files before letting an agent work in a project. Keep sandboxes enabled to restrict what the assistant can access, and leave approval requirements on so the agent has to ask permission before taking certain actions.\n\nIf you suspect an assistant has already followed malicious instructions, check its settings for unfamiliar servers or connections and revoke and replace potentially exposed login tokens. Deleting the original text file may not undo changes the assistant has already made.\n\n\"The thing to watch is not this file or this folder,\" the researchers wrote. \"It is the agent itself — software that reads untrusted input, holds your credentials, and acts with your authority, sitting in a blind spot the old tools were never built to see.\"\n\n*Want more [science](https://mashable.com/science)* *and tech news delivered straight to your inbox? Sign up for [Mashable's Light Speed newsletter](https://mashable.com/newsletters)* *or [get Mashable push alerts](https://mashable.com/life/how-to-set-up-mashable-push-notifications)* *today.*\n\nTopics\n[Cybersecurity](https://mashable.com/category/cybersecurity)\n\nOlivia Tauber is the deputy editor of digital culture, covering creators, media, movies, beauty, and more. Based in New York, her work has appeared in The New York Times, Vanity Fair, The Cut, Teen Vogue, Complex, and Interview Magazine. She holds a Master's degree in Journalism from NYU and a Bachelor's from the University of Michigan. She also runs Fan Mail, a weekly pop-culture newsletter.", "url": "https://wpnews.pro/news/hackers-find-a-way-to-turn-users-own-ai-agents-and-downloads-folders-against", "canonical_source": "https://mashable.com/tech/hackers-ai-coding-agents-downloads-malware", "published_at": "2026-10-23 16:14:35+00:00", "updated_at": "2026-10-23 16:40:27.180723+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-tools"], "entities": ["Forever", "OpenAI", "Codex", "Anthropic", "Claude Code", "MALFEX", "Checkmarx", "Pillar Security"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/hackers-find-a-way-to-turn-users-own-ai-agents-and-downloads-folders-against", "markdown": "https://wpnews.pro/news/hackers-find-a-way-to-turn-users-own-ai-agents-and-downloads-folders-against.md", "text": "https://wpnews.pro/news/hackers-find-a-way-to-turn-users-own-ai-agents-and-downloads-folders-against.txt", "jsonld": "https://wpnews.pro/news/hackers-find-a-way-to-turn-users-own-ai-agents-and-downloads-folders-against.jsonld"}}