Hackers find a way to turn users own AI agents and Downloads folders against them

A recent security report by Forever has warned that users' Downloads folders may contain files that instruct their AI assistants to install malware. The company caught an AI coding assistant following such instructions on a customer's computer, blocking the installation and tracing the request to a text file named AGENTS.md or CLAUDE.md in the Downloads folder.

These files, meant to provide instructions to the AI, can be manipulated by attackers to download and run malicious software like function-color and MALFEX. The threat stems from the AI's ability to edit files, run commands, and install software based on the permissions granted to it. Developers often use these files to explain how to work on a project, but an attacker can exploit this by leaving malicious instructions.

Forever's researchers demonstrated how a website could drop a file into the Downloads folder without approval, potentially leading to the AI assistant following the attacker's orders. Once the file is written, the malware remains even if the user changes folders. The researchers also devised a test for Claude Code, which successfully redirected the assistant's traffic to a controlled server, exposing a login token and allowing them to send commands back for the assistant to execute.

Forever recommends keeping coding assistants out of the Downloads folder, checking unfamiliar AGENTS.md or CLAUDE.md files before allowing an assistant to work, enabling sandboxes to restrict the assistant's access, and enabling approval requirements for certain actions. If an assistant has followed malicious instructions, users should check its settings for unfamiliar servers, revoke and replace exposed login tokens, and be cautious of the AI itself, as it can read untrusted input and act with the user's authority.