A File in a Downloads Folder Steered an AI Assistant. Give Yours a Folder of Its Own.
An AI assistant that reads a folder will follow instructions it finds there. Where you point it matters as much as what you ask it.
By John Martines · October 31, 2026 · 6 min
Security researchers traced an AI assistant's attempt to install malware to one small file in a Downloads folder. Here is what happened, why it applies to the desktop assistants offices now use, and a fifteen-minute folder routine.
Picture the office manager at a small dental practice on a Friday afternoon. The Downloads folder is a mess: insurance forms, a supplier price list, three versions of the holiday schedule, a dozen files nobody remembers saving. She opens the AI assistant on her computer, points it at Downloads and asks it to sort everything into folders.
It is exactly the kind of job these assistants are good at. It is also, according to new security research, exactly the kind of job that can go wrong. Not because the assistant is broken, but because it reads everything in the folder, including files someone else put there.
On October 22, 2026, the security firm Forever Security published what it found on a customer's computer. An AI coding assistant, the kind programmers use to write and fix software, had tried to install a known malicious software package. Forever's security product stopped the install before anything ran.
The researchers traced the order to one small text file named AGENTS.md. AI assistants look for files with that name to learn how to work in a folder: which commands to run, what rules to follow. This one was sitting in the customer's Downloads folder, which was also the folder the assistant had been told to work in. The file told the assistant to install the package, and the assistant tried.
Forever couldn't tell how the file got there. But they pointed out that Downloads is the one folder a web page can write to on its own. Chrome, Edge and Firefox save downloads there by default without asking about each file, so a single visit to the wrong page can leave one behind. BleepingComputer tested Forever's demonstration page and confirmed it dropped a harmless AGENTS.md into Downloads.
The researchers then repeated the trick in their own lab against OpenAI's Codex and showed a related one against Anthropic's Claude Code. Their conclusion is the part to remember: there is nothing for the AI companies to patch. An assistant that follows the instructions in its folder is doing what it was built to do.
How it got here:
- August 2025: OpenAI introduced AGENTS.md, a plain text file that tells an AI assistant how to work in a project. Many coding tools adopted it.
- December 9, 2025: OpenAI and Anthropic helped launch the Agentic AI Foundation under the Linux Foundation, with AGENTS.md and the Model Context Protocol among its first projects.
- January 12, 2026: Anthropic released Cowork, which lets Claude read and change files in a folder you choose, aimed at people who don't write code.
- October 22, 2026: Forever Security published the Downloads folder incident.
- October 25, 2026: BleepingComputer reported it, and other security outlets followed.
This happened with tools built for programmers. Most small businesses don't run those. But the same idea now sits inside desktop assistants that office staff use every day: assistants that can open a folder, read the files and act on what they find. Our earlier piece, [Outside Text Is Data, Never Orders](/articles/outside-text-is-data-never-orders), covered the general rule. This incident shows where it bites first.
Three things to take from it.
The assistant can't tell your instructions from a stranger's. If a file in its folder says "do this," it may treat that as part of the job. A web page, an email attachment or a shared download can all put words in front of it.
Downloads is the worst folder to start in. It is where everything from the internet lands, much of it unchecked. It is also the folder people most want help cleaning up.
The damage depends on what the assistant may do. An assistant that can only read and suggest is a small risk. One that can install software, move files, send email or sign in to accounts is a large one.
1. Give the assistant a home of its own. Make one folder, call it something plain like "AI work," and point the assistant only there. Copy in the files you want it to work on. Don't point it at Downloads, the desktop or a whole drive. This takes five minutes and removes most of the risk.
2. Never point an assistant at Downloads. If Downloads needs sorting, look through it yourself first, delete what you don't recognize, and move the rest into the AI work folder.
3. Keep the approval prompts on. Most desktop assistants ask before they run a command, install something or change files outside their folder. Leave that on. If a file, a web page or a setup guide tells you to turn it off, treat that as a warning sign.
4. Watch for instruction files you didn't write. If you see a file named AGENTS.md or CLAUDE.md in a folder you're about to hand to an assistant, and nobody on your team made it, open it and read it before the assistant does. If it tells the assistant to install anything or change settings, delete it and tell your IT partner.
5. Write it into your AI rules. Two lines are enough: "AI assistants work only in their own folder" and "nobody turns off an approval prompt because a file or a website said to." Our [Staff AI Rules Kit](/tools/staff-rules) can add them to your policy.
Run these with whoever looks after your computers, or with the vendor:
- Which folders can each assistant on our computers read, and which can it change?
- Can it install software or run commands, and does it ask first every time?
- Does it read instruction files like AGENTS.md on its own, and can we turn that off?
- Is our security software watching what the assistant installs or runs?
- If something goes wrong, is there a log of what the assistant did, and who reads it?
AI assistants are moving out of the chat box and onto your computers, into your folders and your files. That is where most of their usefulness is. It is also where anyone who can get a file onto your machine can try to give them orders. The fix isn't to stop using them. It's to decide on purpose what each one can see.
So back to the dental office. The Friday cleanup still happens. The office manager makes an AI work folder, moves in the files she wants sorted, and points the assistant there. Downloads gets a quick look by a person first. That one habit turns a stranger's file into just another file.
---
Sources (checked October 31, 2026). The incident, the malicious package, how the file reached Downloads and the researchers' conclusion: Forever Security report (Oct 22, 2026), as reported in "AI coding agents hijacked using AGENTS.md file in Downloads folder" (BleepingComputer, Oct 25, 2026), including BleepingComputer's test of the demonstration page. Further coverage of the Codex and Claude Code tests and the recommended precautions: The Hacker News (Oct 2026), Help Net Security (Oct 2026), InfoWorld (Oct 2026) and Dark Reading (Oct 2026). AGENTS.md origins: "AGENTS.md" (InfoQ, Aug 2025). Agentic AI Foundation: OpenAI, "Agentic AI Foundation" (Dec 9, 2025). Cowork: "Anthropic's new Cowork tool offers Claude Code without the code" (TechCrunch, Jan 12, 2026).