Rogue file in Downloads folder targets AI coding agent

A malicious instruction file sitting in a developer's Downloads folder attempted to make their AI coding agent install a known-malicious npm package, the security firm Forever Security said in a report published last week and covered on 26 October 2026.

According to the company, the attempt was caught on a real customer's machine. The agent was stopped before any code ran. Forever Security said it could not determine how the file came to be in the Downloads folder.

The case is a compact example of prompt injection, the technique in which attacker-controlled text is placed where an AI system will read it and treat it as an instruction rather than as data. In this instance the attacker-controlled text was not delivered by email or hidden in a web page, but simply left as a file on the developer's own computer, in a folder that almost every machine has and that almost no one audits.

That matters because of how coding agents work. An agent asked to help with a task will often read files on the local disk to work out what the developer is doing. Anything it reads becomes part of the context the model uses to decide what to do next. If a file contains text written to look like an instruction, the agent may follow it. The agent does not have a reliable way to tell the difference between a note the developer wrote and a note an attacker planted.

The payload described in the report is a known-malicious npm package. The npm registry hosts JavaScript packages that developers install as dependencies, and installing one typically runs its scripts on the developer's machine with the developer's own permissions. An agent with the ability to run shell commands can perform that installation without a human approving each step, which is what makes an instruction file a plausible attack path rather than a theoretical one.

Forever Security's account stops short of attribution. The firm did not say who planted the file, how it arrived, or whether the developer was targeted specifically. Nothing in the report indicates the package was installed or that data left the machine.

The practical lesson for teams running coding agents is about scope. An agent that can read the whole home directory is an agent that can read whatever an attacker manages to put there, by download, by shared folder sync, by an extension, or by any other route. Limiting which directories an agent may read, requiring explicit human approval before package installation, and checking package names against known-bad lists are all controls that would have blocked the chain at some point, though the report does not say which control caught this particular attempt beyond stating the agent was stopped before execution.

The incident also underlines a gap in incident response for agent systems. Because the firm could not establish how the file arrived, the root of the attack remains open. A security team that finds a planted instruction file faces the same problem a team finds with any planted payload: the file itself tells you what was wanted, not how it got in.

Forever Security described the event as confirmed. No customer was named in the report.