Hackers find a way to turn users own AI agents and Downloads folders against them

Security company Forever reported in an Oct. 22 blog post that it caught an AI coding assistant following malicious instructions planted in a customer's Downloads folder, blocking the installation and tracing the request to a text file that told the assistant to install "function-color," a package linked to the MALFEX malware campaign documented by Checkmarx. In isolated tests, Forever said OpenAI's Codex downloaded and ran the malware and altered settings so the attacker's server loads at startup in every future session — "You can leave the folder. The poison stays." — while a separate attack against Anthropic's Claude Code succeeded about half the time, redirecting traffic to a researcher-controlled server and exposing a login token.

Hackers find a way to turn users' own AI agents and Downloads folders against them Olivia Tauber https://mashable.com/author/olivia-tauber Read Full Bio https://mashable.com/author/olivia-tauber Your Downloads folder probably contains a few PDFs, forgotten screenshots, and several files named some variation of "final." But according to a recent report by security company Forever, it could also contain instructions telling your AI assistant https://mashable.com/article/ai-assistant-commands-for-daily-use to install malware https://mashable.com/tech/rathat-android-malware-records-screen-touches . In an Oct. 22 blog post https://forever.security/blog/hijacking-ai-agents-via-downloads-folder , the company reported that they caught an AI coding assistant https://www.youtube.com/watch?v=FEHcJbTz16M following those instructions on a customer's computer. The company blocked the installation, then traced the request to a text file in Downloads. How does a text file get that kind of power? Tools like OpenAI's Codex https://mashable.com/article/openai-releases and Anthropic's Claude Code https://mashable.com/article/anthropic-used-mostly-ai-to-build-claude-cowork-tool can, depending on their permissions, edit files, run commands, and install software. Developers leave them instruction files called AGENTS.md or CLAUDE.md to explain how to work on a project. If you're building a website, those notes might tell the assistant which fonts to use or what to test before finishing. You May Also Like An attacker can leave instructions, too. In this case, the file told the assistant to install "function-color," a software package linked to the MALFEX malware campaign documented by Checkmarx https://checkmarx.com/zero-post/malfex-npm-malware-campaign-three-payloads-and-an-adversary-that-signs-their-work/ . Forever didn’t establish how the file reached the customer's computer, but its researchers demonstrated one possible route. Depending on browser settings, a website can drop a file into Downloads without asking for approval. If someone then launches their coding assistant in that folder, it could read the file and follow its orders. When Forever tested the customer's file on an isolated computer, it said Codex downloaded and ran the malware. It also changed settings that could make the attacker’s software load in later sessions. Terms of Use https://www.ziffdavis.com/terms-of-use and Privacy Policy https://www.ziffdavis.com/ztg-privacy-policy . "Once it is written, every Codex session on the machine loads the attacker’s server at startup — in any folder, any project," the researchers wrote. "You can leave the folder. The poison stays." The team separately devised a test targeting Claude Code. The attack worked about half the time, redirecting Claude's traffic to a server the researchers controlled. That exposed a login token and allowed them to send commands back for the assistant to execute, illustrating the risk of giving an assistant access to your computer when it can mistake a stranger's instructions for its own assignment. Researchers have pulled off similar tricks before, showing what AI can really do in the wrong hands. In March 2025, Pillar Security researchers https://www.pillar.security/blog/new-vulnerability-in-github-copilot-and-cursor-how-hackers-can-weaponize-code-agents got AI coding assistants to slip harmful code into a project by hiding malicious instructions in their coding rules. In April 2026, NVIDIA’s researchers used a poisoned AGENTS.md file https://developer.nvidia.com/blog/mitigating-indirect-agents-md-injection-attacks-in-agentic-environments/ to get Codex to sabotage software and conceal the change. This time, though, Forever says it caught an actual attacker trying the trick on a customer's computer. Yikes. How to protect yourself Forever recommends keeping coding assistants out of your Downloads folder and checking unfamiliar AGENTS.md or CLAUDE.md files before letting an agent work in a project. Keep sandboxes enabled to restrict what the assistant can access, and leave approval requirements on so the agent has to ask permission before taking certain actions. If you suspect an assistant has already followed malicious instructions, check its settings for unfamiliar servers or connections and revoke and replace potentially exposed login tokens. Deleting the original text file may not undo changes the assistant has already made. "The thing to watch is not this file or this folder," the researchers wrote. "It is the agent itself — software that reads untrusted input, holds your credentials, and acts with your authority, sitting in a blind spot the old tools were never built to see." Want more science https://mashable.com/science and tech news delivered straight to your inbox? Sign up for Mashable's Light Speed newsletter https://mashable.com/newsletters or get Mashable push alerts https://mashable.com/life/how-to-set-up-mashable-push-notifications today. Topics Cybersecurity https://mashable.com/category/cybersecurity Olivia Tauber is the deputy editor of digital culture, covering creators, media, movies, beauty, and more. Based in New York, her work has appeared in The New York Times, Vanity Fair, The Cut, Teen Vogue, Complex, and Interview Magazine. She holds a Master's degree in Journalism from NYU and a Bachelor's from the University of Michigan. She also runs Fan Mail, a weekly pop-culture newsletter.