AI Governance Institute
← News
Research2026-10-26

90% Hijack Rate Turns AI Coding Agents Into Attack Tools via Download Folder

What happened

Security researchers at Forever Security published findings showing that a file named AGENTS.md can redirect AI coding agents such as OpenAI Codex and Claude Code. Attackers place the file in a user's Downloads folder to execute commands of their choosing. The technique, described in AI coding agents hijacked using AGENTS.md file in Downloads folder, works because these agents read instruction files from accessible directories. The Downloads folder is typically within that range. The attack achieved a 90% success rate across tests. The behavior is a feature of how coding agents read and follow instructions, not a software defect. Because no defect exists, both OpenAI and Anthropic have indicated there is no patch forthcoming. Defense responsibility falls entirely on the organizations and developers running these tools. This follows a broader pattern of coding agent vulnerabilities covered previously, including the Claude Code flaw that let malicious files steal developer credentials without a click and the Plugin4Shell flaw that broke approved-plugin controls across four major AI coding agents.

Why it matters

  • ·AI coding agents are production tools in software development pipelines at most large enterprises. A 90% success rate means an attacker who can place a file in a developer's Downloads folder can reliably redirect that agent to run harmful commands. That access can come through phishing, a malicious download, or a supply chain compromise.
  • ·Because no vendor patch is coming, this is an operator control problem, not a vendor remediation problem. Compliance and risk teams cannot wait for OpenAI or Anthropic to close the gap. They must impose working directory restrictions and file review requirements on their own developer populations now.
  • ·This attack vector intersects with existing regulatory expectations around agentic AI security. Guidance from the Five Eyes Guidance on the Careful Adoption of Agentic AI Services already calls on enterprises to restrict what directories and resources agents can access. Organizations that have not acted on that guidance face compounding exposure.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Free every Thursday. Unsubscribe anytime.

Governance controls affected

AGT-001Agent Permission BoundariesAGT-008Agent Environment IsolationAGT-007Agent Scope and Task BoundariesSEC-001Prompt Injection PreventionAGT-019AI Tool and Plugin Supply Chain Risk Assessment

What to do now

  • ☐Ask your engineering team which AI coding agents (such as OpenAI Codex, Claude Code, or similar tools) are in use, and confirm whether their working directories are restricted to specific project folders or left open to broader paths like the Downloads folder.
  • ☐Require that AI coding agents be configured to read instruction files only from explicitly approved project directories, and prohibit them from reading instructions from user download or temporary folders.
  • ☐Issue interim guidance to all developers using AI coding agents telling them not to open or run agents in sessions where unexpected files may have been downloaded, and to review any unfamiliar instruction files before allowing agent execution.
  • ☐Confirm with your security team that AI coding agent environments run in isolated containers or restricted execution environments that limit what commands the agent can actually carry out, even if it is hijacked.
  • ☐Add AGENTS.md and similar agent instruction file types to your data loss prevention and file integrity monitoring policies so unexpected files of this type trigger an alert.

What to watch next

Enterprises should monitor whether OpenAI, Anthropic, or other coding agent vendors introduce optional controls such as allowlists for instruction file paths. Such controls would make this a configurable rather than purely operator-managed risk. Regulatory pressure on agentic AI security is also intensifying. The Five Eyes Guidance on the Careful Adoption of Agentic AI Services is already in circulation. Further guidance from NIST and sector regulators on agent containment is expected in the coming months. Organizations subject to model risk management expectations, particularly in financial services, should treat this finding as evidence that their current coding agent controls require a documented re-assessment.

Related Coverage

Corporate Policy2026-11-05

Anthropic Won't Patch Claude Dispatch Flaw That Lets Attackers Run Commands Across Enterprise Machines

A security researcher disclosed a flaw in Anthropic's Claude Dispatch feature. It allows a malicious or hijacked browser extension to run commands on any machine sharing the same Claude account session.

Corporate Policy2026-11-15

OpenAI's Daybreak Security Agents Raise Conflict-of-Interest Questions for Vendor Risk Teams

OpenAI announced two AI-agent-powered security products, Daybreak Red Team and Daybreak Defense Factory, at its Cyber at the Frontier event on November 12, 2026. Red Team uses multiple agents to find and confirm vulnerabilities in web applications, while Defense Factory investigates findings and prepares code fixes for engineer review. Neither product deploys changes automatically; engineers must approve patches before any code is merged.

Research2026-11-13

EchoLeak Proves AI Assistants Cannot Defend Against Prompt Injection Alone

A flaw named EchoLeak was patched by Microsoft in May 2025. It showed that a crafted email could cause Microsoft Copilot to silently send sensitive data to an attacker through an automatically loaded image. Security researchers publishing in November 2026 argue the underlying weakness persists across all AI assistants, because no AI model can reliably distinguish legitimate content from hidden attacker instructions. Enterprises using AI assistants with access to email, documents, or internal systems need architecture-level controls that sit outside the model itself.