Security firm Forever says it blocked a real attempt to trick an AI coding assistant into installing malware, using a text file sitting in a Downloads folder.
A plain text file in a Downloads folder told an AI coding assistant to install malware, and the assistant tried to follow along. Security company Forever says it caught this on a customer's computer and blocked the installation. It published its findings in an Oct. 22 blog post.
Tools like OpenAI's Codex and Anthropic's Claude Code can edit files, run commands and install software, depending on the permissions they are given. Developers often leave them notes in files called AGENTS.md or CLAUDE.md. The notes explain how to work on a project, such as which fonts to use or what to test first.
An attacker can write those notes too. In this case, the file told the assistant to install a software package called "function-color," which is linked to the MALFEX malware campaign documented by Checkmarx. Forever blocked the install and traced the request back to the text file.
Forever did not establish how the file reached the customer's computer. Its researchers did show one possible route. Depending on browser settings, a website can drop a file into Downloads without asking. If someone then starts their coding assistant in that folder, it can read the file and treat it as real instructions.
When the team ran the customer's file on an isolated computer, it said Codex downloaded and ran the malware. It also changed settings so the attacker's software would load in later sessions. In the researchers' words, "You can leave the folder. The poison stays."
A separate test aimed at Claude Code worked about half the time. It sent Claude's traffic to a server the researchers controlled, exposed a login token and let them send back commands for the assistant to run.
This matters most to developers and small businesses that let a coding assistant work on their computers. If you do not use these tools, there is nothing to change here. Similar tricks have been shown before. Pillar Security researchers did one in March 2025, and NVIDIA researchers did another in April 2026. What is different now is that Forever says a real attacker tried it on a real customer.
The alert box above lists the steps. The short version is to keep the assistant out of Downloads, read unfamiliar instruction files first, and leave the safety limits on. One more point: deleting the original text file may not undo changes the assistant already made.
It is not yet clear how the file got onto the customer's computer, or who was behind it. Forever's broader warning is about the assistant itself, which reads untrusted input, holds your credentials and acts with your authority.
If you use an AI coding assistant, keep it out of Downloads, read unfamiliar instruction files first, and leave permission prompts on.
A leak shows how Apple may tighten Full Disk Access on Macs, the setting that lets an app read nearly everything, as AI agent apps ask for it more often.
Read more: Apple plans to make it harder for AI apps to see all your Mac filesA viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about youAmazon is testing a way to search, compare and buy products by text message with Alexa for Shopping, starting with a small group of invited US customers.
Read more: Amazon lets you shop by text message with its Alexa assistant
