One Text File Can Make an AI Install Malware #AI #cybersecurity

Your AI coding assistant could be working for a hacker, and all it takes is a text file. Security researchers have caught a real attempt to trick an AI coding agent into installing malware.

The instructions weren’t coming from the developer. They were hidden inside a file in the computer’s Downloads folder. The agent treated that file like legitimate project instructions and attempted to install malicious software.

Fortunately, security controls stopped the attack. Researchers then reproduced the technique against OpenAI’s Codex and demonstrated a similar attack against Claude Code that exposed login tokens.

Here’s what you need to do. Don’t run coding agents from your Downloads folder, and check any AI instruction files you didn’t create, because your AI agent could be following somebody else’s orders.