AI Coding Agents Targeted by Malicious Files in Downloads Folders

Security researchers have identified a new attack vector targeting AI coding agents, where malicious instruction files hidden in a user’s local directory attempt to trick automated tools into installing malware.

The incident, discovered by researchers at the security firm Forever Security, involved a malicious file located in a developer’s Downloads folder. The file was designed to be scanned by an AI agent, which would then be prompted to install a known-malicious package from the npm registry. The security firm intervened to stop the agent before any code was executed on the customer’s machine.

Exploiting AI Agent Autonomy

AI coding agents are increasingly used to automate software development tasks, often possessing the capability to read local project files and execute terminal commands. This incident demonstrates a form of indirect prompt injection, where an attacker does not interact with the AI directly but instead places malicious data in a location the AI is likely to process.

By including specific instructions in a file format the agent is programmed to interpret, attackers can attempt to bypass traditional security prompts and leverage the agent’s autonomy to compromise the host system. In this instance, the target was an npm package, a common vector for supply chain attacks.

Uncertain Origin of Malicious Files

While the attempt was thwarted, the method by which the malicious file arrived in the user’s folder remains undetermined. Researchers suggest that such files could be delivered through drive-by downloads, social engineering, or bundled with other legitimate-looking developer resources.

As AI agents become more deeply integrated into software development workflows, the security perimeter shifts from the user’s manual actions to the data the AI processes. The incident highlights a significant risk where autonomous agents may lack the context to distinguish between legitimate project requirements and malicious instructions embedded in local files.

To mitigate these risks, developers using AI-driven tools are advised to implement “human-in-the-loop” requirements for high-risk actions, such as package installations or script executions. Restricting the file-access permissions of AI agents to specific project directories, rather than allowing broad access to system folders like Downloads, can also reduce the attack surface for this type of exploitation.

The discovery by Forever Security serves as a critical reminder that as tools become more autonomous, the oversight of the data they consume becomes a vital component of enterprise security.