# AI coding agents hijacked using AGENTS.md file in Downloads folder

> **Open Intelligence Dossier** · First detected: 2026-10-26 07:00 UTC · Category: Technology

## Executive Summary
Hackers are hijacking AI coding agents by exploiting malicious files placed inside local Downloads folders.

## Intelligence Brief
Recent coverage details a security vulnerability where hackers have found a way to target users' own artificial intelligence systems and Downloads folders against them. Specifically, malicious text files are being utilized to compromise AI coding agents. According to reporting from outlets including Yahoo Tech, NeoTeo, Mashable, The Hacker News, and BleepingComputer, this method involves attackers leveraging a file named AGENTS.md situated within a user's Downloads folder to carry out the hijacking operation. Publications such as BleepingComputer and The Hacker News emphasize the mechanics of this specific threat vector, noting that the malicious file attempts to trick the AI coding agent into installing malware on the affected system.


The coverage focuses heavily on the unexpected nature of the attack surface, highlighting how user tools and routine storage directories are being weaponized through text-based instructions rather than traditional binary payloads. Outlets provide analysis on what the reported incident shows regarding the current security posture of automated development tools. This emerging situation builds on growing concerns surrounding the autonomy and instruction-following capabilities of artificial intelligence coding assistants deployed on local machine environments. Because these agents are designed to read project files, documentation, and directories to assist developers, the presence of an unauthorized instruction file in a common directory like the Downloads folder creates a direct pathway for manipulation.


Coverage does not yet specify the total number of affected users or the identities of the specific developers behind the targeted AI tools. Future developments will depend on how software vendors and security researchers respond to this specific file-based attack vector. Observers will be monitoring whether upcoming software patches or updates introduce new permission boundaries for AI agents operating near sensitive user directories. Coverage does not currently detail any official fixes or timelines for mitigation, leaving users to monitor developments as reporting continues to unfold across technology platforms.

## Multi-Source Evidence Table
| Source Outlet | Headline | Verification URL |
|---|---|---|
| Martin Cid Magazine | Claude Code and Codex obey a file any website can drop in your Downloads | [Source Link](https://news.google.com/rss/articles/CBMilwFBVV95cUxPbUd4aFpMMGRzTWlQMjd4OWJFTUZSMVFPM3k2QTVVQnk4YWs1bE51U0lUZGw5cmtMWWdSWFItOFplYzdMQ2ZvX2VCaUVPYWlYZmxlbHJubWlyT0NaWFFTY21FVExoY2dmX2dtTjJkY3g5MTNTSnJzSW1fMUFqelhNZlFyS1VTN253UGZYUnctbXVuTUdRMWlV?oc=5) |
| Yahoo Tech | Hackers find a way to turn users' own AI agents and Downloads folders against them | [Source Link](https://news.google.com/rss/articles/CBMikAFBVV95cUxNWUJoTDlyVElzaEVZb0VMbWpYa1ZSMjB6T3Y4MzAyTmdWUVVzRFhydjNhWjVFaER5Szh0N1dzdG5GTzFQSUtidFJac2lTMmdXSGR6a0NZUGRwSnp1RVJjTGdiVjZsZkhnOTcxckFVNFd2Zm5WNnl1Wm43Wmp1VTd1d1FsbndQT29wR2JtQzUtelE?oc=5) |
| NeoTeo | AGENTS.md attack: What the reported incident shows | [Source Link](https://news.google.com/rss/articles/CBMilgFBVV95cUxNdS1iazdybTRxVlgyWEtaeWdOelQxbHEtb0NuMnR5RmpZUU5EakdSXzRGNXhyRXNnS3gxNFZfVGcwbmhjUXNURy1IYWd6WjJvRWhQSVAwelNsbXFqT2M4Z2NGVEN3ZjlQZlZtUzFJb043YWkyWGZGMWVzc1pKY09IeVN1bUwtNV9JNEI1czNvcmVHRm0yekE?oc=5) |
| Mashable | Hackers target AI coding agents with malicious text files | [Source Link](https://news.google.com/rss/articles/CBMid0FVX3lxTE1MZmdVUEhMSENfZ0dmRkY0a3c1VlJyeTEwVEpzdGQyV3RRNF9pX1hxeVdwdE04N2lJeG1hUkRvdy05Tk1HMzRCUk4wVnVfN2Q4aFJUQlNtV3ZwUXlrYjZ0VjJuQ1E0QkRvSk55NEw5MUhMTHJkeG9z?oc=5) |
| The Hacker News | Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware | [Source Link](https://news.google.com/rss/articles/CBMifkFVX3lxTE15ZHdheVQ5cVEzNzhBZnJJa1p0R0phR1ppdl92R0NWdEdzbnlINnZBSEQ2cXFCaWYyRGtXQW94ek4yTDZXMy1PV0dHM2xIc2FuOTNMNkNuN0FJbUtWY1FqTEN4SHlKamotOXNfczM5cS16bnF4eW03WUEtd0VKdw?oc=5) |
| BleepingComputer | AI coding agents hijacked using AGENTS.md file in Downloads folder | [Source Link](https://news.google.com/rss/articles/CBMiswFBVV95cUxOS01RZUp0dnU1dVBJUlNfQmlveWJ3RnhfeHhEckVPbVAzVGwxdzN0LWNSTVFfbC13Yk9RaDBud2VmVFBTVnA5LWI2ZThtWkFoeERwMHpnNjFmWWFCNUl3QUY2MVlhSG8zU2VDR2xVbXQ1c3lYNlhlbWRJZk1EX2lhMXBCN1d2NmZ5SzRIOUNaZ1NqWUJDUVZwV3M1NGFLdHB1NWpiOUJOREJkVnVZek5iNVduMNIBuAFBVV95cUxPUG9uWS1aNS1DZkhSMDdkaUh2eGVHeU1QLU0zUDhJNl9NelR3YWE1X0xhdU13aTZrcVdfV0w5WDlCM25OWUdLaEZpTTZOZzFnQ2l0WG1ZaHdmWUlYMURKZGttUzZJSG42YlQwVzVJcXdSMXJaWTNWd0ZLcWY5VmVvS3RrNWtuVXBVMXBmN192cmV1bUx3ZFVQSFJhSzJ1R01) |

---
*Canonical Source: https://pulse.byoviral.com/trend/2026-10-26/ai-coding-agents-hijacked-using-agents-md-file-in-downloads-folder*