Researchers trace an attempted malware install to a Downloads instruction file
Forever Security traced an attempted rogue-package install to AGENTS.md in a customer’s Downloads folder. BleepingComputer tested a harmless download step; how the original file arrived remains unknown.
Artificial Intelligence··Morning
An attempted install traced to a local instruction file
Forever Security says it stopped a coding agent on a customer’s computer while the agent attempted to install a known malicious npm package. The firm traced the command to an AGENTS.md instruction file in the customer’s Downloads folder, which was also the agent’s working directory. It says the package was blocked before its code ran. The researchers could not establish how that file reached Downloads. Their later laboratory demonstrations explore plausible ways to place instructions there, but they do not prove the route taken in the customer incident. The customer’s agent acted on the file, and Forever Security blocked the package before its code ran.[2], [1]
A browser download is one link, not the whole attack
BleepingComputer examined one part of the proposed path itself. Its harmless demonstration page saved a test AGENTS.md file into Downloads in browsers that use that location by default. The publication also noted that Chrome, Edge and Firefox showed download notifications, while Brave asked for approval. This browser test confirms that a file can arrive in the folder under those conditions. It does not show that the original malicious file arrived from a website, or that opening a page by itself made a coding agent run a command. The later step requires an agent to work from the folder and read the file.[1]
The working folder changes what an agent reads
Forever Security also reported separate tests against Codex and Claude Code, with different outcomes and instruction files. Those experiments establish a possible failure mode under the permissions and settings used in the tests; they are not independent measurements of how often every user would be affected. The incident points to a trust boundary between downloaded material and project instructions. A file that looks like ordinary text can influence a coding agent when it is treated as local working guidance. Keeping the agent’s work scoped to the intended project may reduce the chance that an unrelated download will be read as an instruction.[2], [1]
