Coding agent tried to install malware from a planted Downloads instruction file
Review RAT-074 · Catalogue RAT-074
Original Forever report plus BleepingComputer direct interview support one real customer’s blocked malicious-package installation attempt after a planted AGENTS.md. The customer’s organizational ownership and occurrence date are undisclosed. Browser delivery, full execution, and token theft belong to reconstructions, not the live attempt. Two publishers share Forever as source for the customer event; no independent customer forensics.
Reviewed: · Rule: roguewatch-organizational-harm-v1
Dates and discovery
- Incident date
- Not disclosed
- Added to research / record
- Posted to RogueWatch
- No linked public incident
- First observed
- 2026-10-30T13:13:36.306166Z UTC
- Discovery channel
- User-supplied comparison audit
- Discovery source
- https://rogueaitracker.com/incidents/coding-agent-downloads-malware-attempt/
When to reconsider
New first-party traces or substantive corroboration from another publisher clarifies the identified authorization, organizational-victim, chronology, or outcome gap.
Dates use America/Los_Angeles. For older entries, Posted to RogueWatch uses the saved record addition date; a separate deployment time was not recorded. Future posting timestamps record first public qualification. Source publication and incident occurrence are separate.
Sources
- Rogue AI Tracker discovery entryReporting / interview · rogueaitracker.com
- forever.securityOriginal account · forever.security · Published 2026-10-22
- www.bleepingcomputer.comReporting / interview · www.bleepingcomputer.com · Published 2026-10-25
Decision history
- · Case-by-case comparison audit
RAT-074: awaiting-evidence. Original Forever report plus BleepingComputer direct interview support one real customer’s blocked malicious-package installation attempt after a planted AGENTS.md. The customer’s organizational ownership and occurrence date are undisclosed. Browser delivery, full execution, and token theft belong to reconstructions, not the live attempt. Two publishers share Forever as source for the customer event; no independent customer forensics. Source checks: read: https://forever.security/blog/hijacking-ai-agents-via-downloads-folder. Forever reports one real customer coding agent stopped while trying to install malicious function-color after reading AGENTS.md from Downloads. Customer identity/organization, event date, and delivery route undisclosed. Full execution and token theft were separate tests. read: https://www.bleepingcomputer.com/news/security/ai-coding-agents-hijacked-using-agentsmd-file-in-downloads-folder/. BleepingComputer directly interviewed Forever and independently reproduced a harmless browser download. It did not independently examine the customer incident or establish how the real file arrived; same underlying Forever account for the blocked install.
Evidence source · Evidence source - · Retained review-queue assessment
Original Forever report plus BleepingComputer direct interview support one real customer’s blocked malicious-package installation attempt after a planted AGENTS.md. The customer’s organizational ownership and occurrence date are undisclosed. Browser delivery, full execution, and token theft belong to reconstructions, not the live attempt. Two publishers share Forever as source for the customer event; no independent customer forensics.
Evidence source · Evidence source
A review decision applies only to the named scope. Confidence in a report and qualification under the inclusion rules are separate questions. Review records do not add incidents to the globe or leaderboard.