AI agents tricked by a rogue downloads file into running dangerous malware

A security company reported that a malicious instruction file in a developer’s Downloads folder attempted to get an AI coding agent to install a harmful npm package.

• Forever Security said it detected the attempted attack on a customer’s machine.· 1 source
• The file attempted to direct an AI coding agent to install a known-malicious npm package.· 1 source
• A separate snippet says AI agents may read content in an AGENTS.md file, including one downloaded from the internet.· 1 source