A file in Downloads tries to trick your AI agent

The security of AI agents that already work inside our teams is no longer a laboratory hypothesis. The security firm Forever Security has published a report describing how a malicious instruction file, placed in a developer's Downloads folder, tried to convince their AI coding agent to install an npm package known to be harmful. The incident was detected on a client's real machine and the agent was stopped before a single line of code was executed.

There is one detail worth highlighting: the security firm could not determine how that file reached the Downloads folder. In other words, the entry point remains a mystery. And that, for any small business starting to use coding assistants, should raise a warning flag.

What exactly happened

The attack vector does not exploit a memory flaw or a classic vulnerability. It takes advantage of something much simpler: the trust the agent places in the files it finds in its working environment. A file with instructions, apparently harmless, is placed in a path that the assistant frequently checks and induces it to perform a specific action: install an npm package that is already flagged as malicious.

The agent, if it has no brakes, obeys. And that is the problem: current coding assistants are designed to be helpful, not to distrust their own desktop. The attack chain relies on the developer's legitimate automation to turn it into the vehicle for the malware.

Why this matters to a small business

Until recently, the risk of AI in development was associated with the quality of the generated code or with data leaking to the model provider. This case adds a new layer: the agent as an executor of instructions that the user did not write. If your team has adopted assistants such as Claude Code, Cursor or similar, you already have a process running that reads files from the system and decides what to do with them.

In a small business with a small IT team, that process usually coexists with broad permissions, shared folders and a fairly relaxed download policy. The combination is delicate. You don't need a sophisticated attacker: it is enough for a file to end up in the wrong place and for the agent to interpret it as an order.

An AI agent does not distinguish between a legitimate instruction and one placed by a third party if no one has taught it to do so.

What we recommend at ForgeNEX

This is not about giving up coding assistants, which deliver real productivity. It is about setting sensible limits on them. These are the measures we are applying with our clients:

• Review the agent's permissions. It should not be able to install packages or run system commands without the developer's explicit confirmation. The convenience of full automation does not offset the risk.
• Limit the read paths. The agent should work on the project directory and not on Downloads, Desktop or personal folders. It is a simple configuration and eliminates much of the problem.
• Audit npm dependencies. A malicious package installed is an open door. It is worth reviewing the dependency tree and blocking unverified versions.
• Train the team. No one should leave unknown files in folders that the assistant checks. Digital hygiene is once again the first line of defense.
• Log the agent's activity. Without traces there is no possible investigation. If something happens, we want to know what it read, what it executed and when.

The broader context

This incident fits a trend we have been observing: attackers are moving from looking for technical flaws to manipulating workflows that already work. We saw it with AI agents in the service of ransomware and we see it again here, with a legitimate agent turned into an involuntary tool of the attacker.

It is also worth reading alongside the comparison of AI assistants that we published this month: each tool has its own permission model and its own way of handling files in the environment. Choosing well is not only a matter of response quality, but also of attack surface.

Conclusion

The news does not describe a disaster, but a warning. Forever Security stopped the attempt before there was any damage, and that shows that detection works when it exists. The problem is that many small businesses do not yet have that level of monitoring over their coding assistants.

If your team uses AI agents for programming, this is the moment to review what they can touch, what they can install and what gets logged. The productivity we gain with AI must be accompanied by proportionate control. At ForgeNEX we help companies in Seville and across Spain integrate these tools without opening doors that are then hard to close.

Source: The Hacker News. Analysis and adaptation: ForgeNEX.