decrypted · 25 october 2026 · supply chain · ai and llm security

A text file in Downloads can hijack your AI coding agent

A text file in your Downloads folder can take over an AI coding agent. Forever Security, a firm that watches AI agent risk, found it on a customer's machine and published on 22 October. The awkward detail is that, in the researchers' view, neither OpenAI nor Anthropic has anything to patch.

A sticky note the agent obeys

Think of a new contractor who reads every sticky note on the desk and does what it says. Coding agents work like that. Codex looks for a file called AGENTS.md and Claude Code looks for CLAUDE.md: plain instruction files in the folder where the agent starts. The agent reads them and follows them with its own permissions. The file contains no malicious software, only words, so malware scanners walk straight past it.

How it worked

Forever says a web page can save such a file into the Downloads folder silently, with no click. Chrome, Edge and Firefox do that by default, according to BleepingComputer; Brave asks first. Forever's own telemetry suggests about half of its customers run an agent inside Downloads. On the customer's machine, the file steered an agent towards installing function-color, a known malicious package from npm, JavaScript's public library of add-on packages. The researchers could not establish how the file arrived.

In their reproductions, Codex ran the malware in more than 90% of attempts. Claude Code followed through about 50% of the time, by redirecting its traffic to a server the researchers controlled. That exposed its OAuth token, the standard that lets one app act for you inside another, and let the server hand back commands to run.

What the defender sees

Very little. A markdown file appears, a configuration file is edited, and a trusted tool runs an install. Forever advises checking Codex's configuration for MCP server entries you did not add (MCP being a standard for plugging AI assistants into other tools), and Claude Code's settings for a redirected API address you did not set. If function-color appears among a machine's installs, treat that machine as compromised and rotate its credentials.

The Secure by Design lesson

The flaw is a missing trust boundary. A folder that any website can write to is being treated as a source of orders. The vendors' position is that the agents behave as designed, which is precisely the problem. A secure default would ignore instruction files outside a project root, or ask first. That is a design decision, not a patch, and users should not have to compensate for it.

Until vendors move, the mitigation costs almost nothing. Start agents in the project folder, never Downloads. Read any instruction file you did not write, including those in freshly cloned repositories. Keep approval prompts and sandboxes on. A UK director should ask one question this week: which laptops run coding agents, and which tokens do they hold? That is opinion, not advice, but the answer is often a surprise.

Also this week

Supply chain: an abandoned domain, millions of machines. Eye Security registered the lapsed update domain of Time4Popcorn, a fork of the Popcorn Time client, and found its Windows and macOS updaters fetched unsigned programs over plain HTTP and ran them as SYSTEM or root (CVE-2026-30612). Eye estimates 2.5 to 3.0 million Windows hosts, and saw connections from corporate, government and military networks. It used the flaw to push an update that disables the updater, and the domains now sit with the Shadowserver Foundation. Android users remain exposed, because that updater cannot be switched off remotely, and Eye recommends uninstalling the app entirely. Lesson: forgotten software still has an update channel, and so does its domain.

Breach: Quest Diagnostics. The US lab firm confirmed in a filing that someone accessed its Quanum Lab Services Manager portal, which clients use to order tests and read results, and that some patient records were likely exposed. Quest says it discovered the incident on 21 October, shut the system down and told clients to use paper requisitions. No group had claimed it, and the number affected is undisclosed. The Record reports Quest says it was unrelated to the recent PHP flaws. No UK impact has been reported, but any NHS or private provider whose results sit in a supplier's portal should know what that supplier holds.

Cloud: Windows Server 2016 runs out. Microsoft's lifecycle page lists the end of extended support for all editions, Datacenter, Essentials, MultiPoint Premium and Standard, in January 2027; mainstream support ended in January 2022. Unsupported servers become unpatched servers, and migration rarely fits inside a quarter. Count yours now, including the forgotten file server in the cupboard, and decide between upgrade, retire or isolate before the date decides for you.

Sources

If you want a second pair of eyes on how your team uses AI coding tools, get in touch.