The security firm detected the attempt on a real customer's machine and intervened before any code was executed. Investigators were unable to determine how the file ended up in the Downloads folder in the first place.

Key points from the report:

• The attack relied on a malicious instruction file dropped in a commonly used directory (Downloads) rather than a traditional exploit.
• The file attempted to direct the AI coding agent to install a known-malicious npm package.
• Forever Security stopped the agent before any code ran, so no execution occurred on the affected machine.
• The initial infection vector remains unknown, as the firm could not establish how the file was placed in the folder.

This incident highlights a growing risk surface around AI coding assistants, which often read files and act on instructions from the local environment. Developers running such agents should be cautious about unexpected files in download or working directories and review what their tools are permitted to install automatically.

Source: The Hacker News

Does your organization restrict what your AI coding agents are allowed to read or install from local directories?