A file that a website saves to the Downloads folder without approval can trick AI coding agents into installing a malicious npm package or handing over the user’s login token …
First seen on helpnetsecurity.com
Jump to article: www.helpnetsecurity.com/2026/10/26/ai-coding-agents-malware-openai-codex/
