What happened
BleepingComputer reported on October 25, 2026 that Forever Security found a malicious AGENTS.md instruction file in a customer's ~/Downloads folder, which was also the working directory of an AI coding agent that then tried to install a rogue npm package called function-color. Because browsers such as Chrome, Edge and Firefox save downloads there by default, a web page can drop a file named AGENTS.md without asking, and any agent later launched in that folder reads it as instructions. In the researchers' tests, a harmless payload ran through OpenAI Codex about 90% of the time, and a planted CLAUDE.md redirected Claude Code's API traffic to their server, exposing its OAuth token and running code in about half of attempts; the researchers say there is nothing for the vendors to patch because the agents are doing what they were built to do. (BleepingComputer: AI coding agents hijacked using AGENTS.md file in Downloads folder, Oct. 25, 2026)
Note on figures: The 90% and roughly 50% success rates, the 'hundreds of customers' and the 1,300-plus Claude Code sessions launched from Downloads are Forever Security's own figures as told to BleepingComputer. The researchers could not determine how the file reached the customer's Downloads folder.
What it means for Canada: our assessment
Assessment: no Canadian victims are reported. Any Canadian developer, analyst or marketer who runs Codex, Claude Code or Cursor CLI from their Downloads folder (for example to sort files or work on something just downloaded) is exposed, and a hijacked agent runs with that person's access to company code, tokens and cloud accounts.
- Sectors
- SaaS and AI startups · Banks and fintechs · Insurance · Marketing and agencies · Government digital teams · Universities and research labs
- Tools involved
- OpenAI Codex · Claude Code · Cursor CLI · npm · Chrome, Edge and Firefox default download settings
- Canadian rules
- PIPEDA: if a hijacked agent exposes customer personal information, report breaches with a real risk of significant harm to the Privacy Commissioner, notify affected people and keep a breach record
Quebec Law 25: record every confidentiality incident and report serious ones to the Commission d'accès à l'information
OSFI B-13: federally regulated financial institutions must manage technology and cyber risk on endpoints, including developer tools such as AI coding agents, and report material incidents to OSFI
OSFI E-23: AI tools used inside regulated institutions fall under model risk management expectations, including controls on what they can access and run
Assessment, not documented exposure. The sources do not name Canadian victims. The exposure is an assessment: Codex, Claude Code and Cursor CLI are widely used by Canadian software and data teams, the trick relies only on default browser and agent behaviour that is the same in Canada, and Forever Security reports hundreds of its customers already launch agents from ~/Downloads.
Takeaways for Canadian businesses and individuals
- BusinessTell staff never to start Codex, Claude Code, Cursor CLI or similar agents in ~/Downloads, the home directory or a broad parent folder; start them in the root of the specific project, as OpenAI and Anthropic recommend.
- BusinessKeep agent approval prompts and sandbox protections switched on, and block 'auto-approve all' or full-access modes on company machines so a planted instruction cannot install packages or run commands silently.
- BusinessHave developers review any unfamiliar AGENTS.md, CLAUDE.md or similar instruction file before letting an agent follow it, and search endpoints and npm logs for attempts to install the package function-color.
- BusinessIf an agent may have followed a planted file, rotate the Claude Code or Codex OAuth tokens and any API keys on that machine, and report a confirmed compromise to the Canadian Centre for Cyber Security (cyber.gc.ca or 1-833-292-3722).
- IndividualsSet your browser to ask where to save each download (Chrome, Edge and Firefox save to Downloads silently by default), and test untrusted code in a separate virtual machine before running it on your main computer.
For the Canadian AI sector
Instruction files are becoming an attack surface in their own right. Canadian AI teams that roll out coding agents to staff should treat AGENTS.md and CLAUDE.md like executable code: set where agents may start, keep approval prompts on, and expect security reviewers to ask about it.
Written by AgentsNorth from the source below. General information, not legal or security advice.