https://www.live-feeds.com/feed/ai-coding-agents-hijacked-using-agents-md-file-in-downloads-folderContinuously updated, source-cited coverage. https://www.live-feeds.com/feed/ai-coding-agents-hijacked-using-agents-md-file-in-downloads-folderhttps://www.live-feeds.com/feed/ai-coding-agents-hijacked-using-agents-md-file-in-downloads-folder#u161276Thu, 29 Oct 2026 07:51:50 +0000Security researchers discovered a supply-chain attack vector where a malicious text file placed in a user's Downloads folder hijacks AI coding agents such as OpenAI Codex and Claude Code. The plain-text instruction file, disguised as ordinary engineering notes, tricks the automated assistant into running malware or installing a rogue npm package. Forever Security caught the attempt on a real customer machine and stopped the agent before code execution occurred. Related testing demonstrated that attackers can also manipulate coding agents into leaking OAuth tokens and hijacking user accoun