Incident report · Prompt injection
Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware
A malicious instruction file in a developer's Downloads folder attempted to trick their AI coding agent into installing a known-malicious npm package. Security firm Forever Security detected the incident on a real customer's machine, stopping the agent before any code execution. The file's origin remained unknown.
- Discovered
- Oct 26 2026
- Failure mode
- Prompt injection
- Source
- The Hacker News · Oct 26 2026
- Impact
- Potential malware installation on a developer's machine via AI agent manipulation.
Summary from the public record. The failure mode’s analysis follows.
The agent did exactly what it was told. The problem was who was doing the telling.
How Fencio prevents this
The agent could not tell the difference between text it was reading and instructions it should follow. Once untrusted content reached its context window, it carried the same weight as the operator's own prompt, and the agent acted on it with every permission it had.
Fencio tags every span of context with where it came from. Instructions that arrive inside retrieved documents, tickets, emails, or tool output are treated as data, and any tool call they try to trigger is checked against the policy for untrusted content before it runs.
Runtime policy example · Prompt injectionLive
- 14:43:37tool.call send_email(to=external)Origin: retrieved content · no egress from untrusted inputBlock
- 14:46:54tool.call search_kb(query)Read-only · within task scopeAllow
- 14:49:11tool.call http.get(unlisted-domain)Domain not on egress allowlistBlock
Say yes to the AI your business wants.
Book a 30-minute call. Bring your agents and your rules.