IncidentsRogue file in Downloads folder targets AI coding agent
Forever Security says it caught a malicious instruction file trying to make a developer's AI coding assistant install a known-bad npm package.
26 Oct 2026
Malicious Downloads file tries to trick AI coding agent into installing malware
Security firm Forever Security found a malicious instruction file in a developer's Downloads folder that attempted to make an AI coding agent install a known-malicious npm package on a real customer's machine; the agent was stopped before any code ran.
Disclosed 26 October 2026 · Record updated 26 October 2026
Impact
Attempted malware installation via a malicious instruction file was detected and stopped before the AI coding agent executed any code.
Our coverage
IncidentsSources
- thehackernews.comhttps://thehackernews.com/2026/10/malicious-file-in-downloads-folder.html