AI coding assistants have moved from novelty to everyday tool. Developers use them. So do analysts, operations people and the one person in every office who "knows a little Python." They read files, run commands and install packages on your behalf.
That last part is where two October 2026 incidents should get your attention.
Incident 1: A Text File in the Downloads Folder
Researchers at Forever Security showed that a website can drop a plain-text AGENTS.md file into your Downloads folder without asking. Coding agents treat files like that as instructions.
When OpenAI's Codex was opened in that folder and given any task, it followed the planted instructions: it changed its own settings and installed a malicious npm package — in more than 90% of the researchers' attempts. Because the settings change applied computer-wide, later sessions in other projects ran the attacker's command too. A similar test against Anthropic's Claude Code, using a planted CLAUDE.md file, got the agent to route its traffic through an attacker's server about half the time.
The researchers' point: the agents did what they were designed to do. They followed instructions in a file they trusted. The fix is in how people use them.
Incident 2: A Leaked Key and a Poisoned Release
On October 21, a release of LiteLLM — a popular open-source tool that companies use to connect to AI models — was published with a credential stealer and remote-access malware inside. The project suspects a GitHub token that leaked through its own gateway logs. Anyone who installed that version was told to rotate their credentials.
It was the project's second supply-chain incident this year.
What These Have in Common
Neither attack is new. They're the oldest lessons in software security, showing up in a new place:
- The environment matters. An agent working in a folder full of random downloads is reading untrusted input.
- The supply chain matters. The packages your tools install are only as trustworthy as whoever published them.
- Keys are passwords. A leaked API token is a leaked login.
A Practical AI Tool Policy
Limit what agents can do without asking
Keep approval prompts and sandboxes on. "Auto-approve everything" is how a planted file becomes an installed package.
Never run agents in Downloads
Work in dedicated project folders. Read any AGENTS.md or CLAUDE.md you didn't write, including in code you just copied.
Pin and verify dependencies
Lock package versions, and don't upgrade the moment a new release appears. A short delay lets the community catch poisoned releases.
Treat API keys like passwords
Scope them to what they need, store them in a secrets manager, rotate them, and keep them out of logs.
Know who's using what
Most businesses don't have a list of which AI tools their people use. Start one. It's the same problem as shadow IT, with more permissions.
AI tools are worth using. They just need the same guardrails you'd put on any new employee with admin rights.
Free AI Tool Risk Review
We'll help you find out which AI tools your team actually uses, what access they have, and put a simple, practical usage policy in place.
DM us "ASSESS" on LinkedIn or schedule a free consultation · (646) 791-2137