A security firm has uncovered a method of compromising AI coding assistants using something as ordinary as a text file in a computer’s Downloads folder. The attacker doesn’t need to exploit the operating system or convince a person to execute suspicious software. Instead, malicious instructions are placed where an AI agent may encounter them during an otherwise legitimate task.
According to research published by Forever Security on October 22 and reported by Mashable, a customer’s AI coding assistant attempted to install a malicious software package after reading instructions embedded in an AGENTS.md file. Forever’s monitoring stopped the installation before the malware executed. The researchers could not establish how the file arrived on the computer, but they demonstrated that a website could deliver a similar file into the Downloads folder without a separate download-approval prompt.
The discovery exposes an increasingly important weakness in autonomous AI: Information encountered during a task can be mistaken for instructions carrying legitimate authority. When an agent has permission to modify files, install software and change its configuration, that confusion can become a security incident.
When a Text File Becomes an Instruction Source
Coding assistants such as OpenAI Codex and Anthropic Claude Code can read project-specific instruction files to understand how developers want their software built and maintained. These files are useful because they communicate coding standards, testing procedures and environmental requirements without requiring the developer to repeat instructions in every conversation.
Attackers can exploit that same mechanism by planting malicious directions inside documents that appear to contain ordinary development guidance.
In Forever Security’s investigation, the malicious file instructed the agent to install a package associated with the MALFEX malware campaign. The instructions were disguised as routine environment configuration and directed the assistant to modify its settings before executing the software.
The implications extended beyond the immediate task. The configuration change could persist across subsequent Codex sessions, potentially allowing the attacker’s instructions to affect unrelated projects.
Laboratory results reinforced the concern
