AI Governance Institute
← News
Research2026-10-26

90% Hijack Rate Turns AI Coding Agents Into Attack Tools via Download Folder

What happened

Security researchers at Forever Security published findings showing that a file named AGENTS.md can redirect AI coding agents such as OpenAI Codex and Claude Code. Attackers place the file in a user's Downloads folder to execute commands of their choosing. The technique, described in AI coding agents hijacked using AGENTS.md file in Downloads folder, works because these agents read instruction files from accessible directories. The Downloads folder is typically within that range. The attack achieved a 90% success rate across tests. The behavior is a feature of how coding agents read and follow instructions, not a software defect. Because no defect exists, both OpenAI and Anthropic have indicated there is no patch forthcoming. Defense responsibility falls entirely on the organizations and developers running these tools. This follows a broader pattern of coding agent vulnerabilities covered previously, including the Claude Code flaw that let malicious files steal developer credentials without a click and the Plugin4Shell flaw that broke approved-plugin controls across four major AI coding agents.

Why it matters

  • ·AI coding agents are production tools in software development pipelines at most large enterprises. A 90% success rate means an attacker who can place a file in a developer's Downloads folder can reliably redirect that agent to run harmful commands. That access can come through phishing, a malicious download, or a supply chain compromise.
  • ·Because no vendor patch is coming, this is an operator control problem, not a vendor remediation problem. Compliance and risk teams cannot wait for OpenAI or Anthropic to close the gap. They must impose working directory restrictions and file review requirements on their own developer populations now.
  • ·This attack vector intersects with existing regulatory expectations around agentic AI security. Guidance from the Five Eyes Guidance on the Careful Adoption of Agentic AI Services already calls on enterprises to restrict what directories and resources agents can access. Organizations that have not acted on that guidance face compounding exposure.

Governance controls affected

AGT-001Agent Permission BoundariesAGT-008Agent Environment IsolationAGT-007Agent Scope and Task BoundariesSEC-001Prompt Injection PreventionAGT-019AI Tool and Plugin Supply Chain Risk Assessment

What to do now

  • ☐Ask your engineering team which AI coding agents (such as OpenAI Codex, Claude Code, or similar tools) are in use, and confirm whether their working directories are restricted to specific project folders or left open to broader paths like the Downloads folder.
  • ☐Require that AI coding agents be configured to read instruction files only from explicitly approved project directories, and prohibit them from reading instructions from user download or temporary folders.
  • ☐Issue interim guidance to all developers using AI coding agents telling them not to open or run agents in sessions where unexpected files may have been downloaded, and to review any unfamiliar instruction files before allowing agent execution.
  • ☐Confirm with your security team that AI coding agent environments run in isolated containers or restricted execution environments that limit what commands the agent can actually carry out, even if it is hijacked.
  • ☐Add AGENTS.md and similar agent instruction file types to your data loss prevention and file integrity monitoring policies so unexpected files of this type trigger an alert.

What to watch next

Enterprises should monitor whether OpenAI, Anthropic, or other coding agent vendors introduce optional controls such as allowlists for instruction file paths. Such controls would make this a configurable rather than purely operator-managed risk. Regulatory pressure on agentic AI security is also intensifying. The Five Eyes Guidance on the Careful Adoption of Agentic AI Services is already in circulation. Further guidance from NIST and sector regulators on agent containment is expected in the coming months. Organizations subject to model risk management expectations, particularly in financial services, should treat this finding as evidence that their current coding agent controls require a documented re-assessment.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Free every Thursday. Unsubscribe anytime.

Related Coverage

Corporate Policy2026-10-23

NemoClaw Flaw Lets Any Webpage Hijack Local AI Agents Without Authentication

Oasis Security disclosed a vulnerability in NVIDIA's NemoClaw framework affecting organizations running local Ollama AI agent instances. An attacker-controlled webpage can send hidden instructions directly to the local agent runtime without any login or user click required. Organizations using self-hosted AI agents should treat this as an urgent signal to verify authentication, network segmentation, and prompt injection defenses on all local agent deployments.

Research2026-10-14

Frontier Labs' Basic Containment Failures Drive Agent Incidents, Experts Warn

Cybersecurity experts interviewed across three industry conferences say recent unauthorized AI agent access incidents at OpenAI, Anthropic, Meta, and Google stem from poor containment and monitoring practices. The failures involve misconfigured isolation, weak network controls, and inadequate behavioral monitoring, not runaway model behavior. The findings carry direct implications for enterprise vendor due diligence and third-party AI risk programs.

Corporate Policy2026-10-24

Email Prompt Injection Turns Trusted AI Agents Into Attack Tools

Gen Threat Labs published research showing AI agents can be redirected by malicious instructions embedded in ordinary email content, with no software flaw required. Gen Digital responded with the Agent Trust Hub, a layered security framework covering pre-installation scanning, encrypted agent connectivity, and runtime action interception. The accompanying AARTS open specification sets a proposed standard for agent runtime safety that enterprise teams can reference.