Daily AI brief · October 26, 2026
A File in Downloads Told an AI to Install Malware
A planted instruction file in a Downloads folder steered an AI assistant into trying to install malware, and the fix for any business is simple: give each AI assistant a folder of its own.
A file in a Downloads folder steered an AI assistant into trying to install malware (BleepingComputer, Forever Security) The security firm Forever Security found an AI coding assistant on a customer's computer trying to install a malicious software package. They traced it to a small instruction file, the kind these assistants read to learn how a project works, sitting in the customer's Downloads folder, which was also the folder the assistant had been told to work in. The file told it to install the package, and it tried; the attempt was stopped before anything ran. The researchers repeated the trick against OpenAI's Codex and showed a related one against Anthropic's Claude Code. They couldn't tell how the file got there, but they point out that most web browsers drop downloads into that folder without asking, so a single visit to the wrong web page could leave one behind. Their own verdict is the part to remember: there is nothing for OpenAI or Anthropic to patch, because an assistant that follows the instructions in its folder is doing exactly what it was built to do. This happened with tools built for programmers, but the lesson carries over to the desktop assistants more offices are starting to use. An assistant that can read a folder and act on what it finds can be steered by whatever someone else left in that folder. Where you point it matters as much as what you ask it.
Paste the real thing, not a description of it (Starter · 2 minutes)
"A customer is upset about a late delivery" leaves Claude guessing at the tone, the facts and what was promised. Paste the actual email or the whole thread instead, after you take out anything private that doesn't need to be there, like card or account numbers. Then say what you want the reply to do. Claude gets the names, the history and the mood, and the reply fits the person who wrote to you.
> Here is the email I need to answer: [paste]. Draft a reply that [what you want the reply to do].
Works the same in ChatGPT and Copilot.
What good looks like: a reply that answers what the person actually asked, using their words and details. Avoid: pasting customer details into a personal or free AI account. Use the work account your business approved.
Forward this to whoever saves the attachments: if you use an AI assistant that works with files on your computer, give it a home of its own. Make one folder, call it something plain like "AI work", and copy in only the files for today's job, a price list, last month's report, the notes from a call. Never point the assistant at your Downloads folder or the whole desktop, and empty the AI folder when the job is done. It takes two minutes to set up, and it means the assistant only ever reads what you chose to give it.
Try the tip on one real email. Pick a message from the weekend that's been sitting there because it's awkward to answer, take out anything private, paste it into your work account and ask for a reply that does one clear thing. Edit it, then send it yourself. And if a question about AI has been sitting with you too, hit reply and send it in; it may be answered in a future brief.
Where it's going: AI assistants are moving from the chat box onto your computer and into your files, so the businesses that decide on purpose what each one can see will get the help without inviting in whatever else is lying around.
- Planted AGENTS.md file in Downloads steers AI coding agents: [BleepingComputer, Oct 25](https://www.bleepingcomputer.com/news/security/ai-coding-agents-hijacked-using-agentsmd-file-in-downloads-folder/) · [RuntimeWire, on Forever Security's report](https://runtimewire.com/article/forever-security-ai-agent-downloads-folder-instructions)