Researchers Flag AI Agent Hijack and Popcorn Time Updater Flaw

Forever Security said it found a live malicious AGENTS.md file in a real customer's ~/Downloads folder. The document, disguised as ordinary engineering notes, instructed the AI agent to deploy malware and exfiltrate session tokens. The researchers stopped it before it caused meaningful damage and could not determine how the file reached the folder; they assumed a browser downloaded it from a website that had likely been compromised.

The technique depends on three conditions: websites can drop some file formats into Downloads without a click or permission; .md files are not treated as dangerous by default; and AI agents follow instructions in AGENTS.md as written. Forever Security reproduced the attack on OpenAI Codex and Claude Code. The researchers said the behavior is not a software bug and cannot be patched, because the agent is following its design in the same way a browser renders a phishing page as designed. The report described Downloads as the one folder a website can drop a file into with no click or permission, and called Markdown the new executable.

During the attempted attack, the agent was directed to install a malicious npm package called function-color, which the researchers said was built two years ago in a separate campaign and had flown under the radar. They said agents could also be tricked into pulling ransomware, infostealers, or remote monitoring and management tools.

Forever Security advised users to treat ~/Downloads as hostile ground for agents, avoid starting Codex, Claude Code, or other agents in that folder, and inspect instruction files they did not write. It also advised checking agent configuration for unexpected proxies or API endpoints such as ANTHROPIC_BASE_URL, keeping approval gates and sandboxes enabled, and rotating tokens if a bypass instruction is found.

In the second disclosure, Eye Security said an abandoned Time4Popcorn client contained a critical updater flaw tracked as CVE-2026-30612, with a severity score of 9.8 out of 10. The updater connected over unencrypted HTTP to the defunct domain popcorntimeupd.xyz and accepted any executable found there without verifying a digital signature.

Eye Security registered the defunct domain and observed up to 3 million Windows and 350,000 macOS client connections to Time4Popcorn, including residential ISPs, government and military networks, and corporate devices. The researchers said the app appeared to have been installed and forgotten. Instead of sending malware, they pushed code that stopped and disabled the updater; it did not delete the app or collect host data.

The operation took from November 2025 to March 2026, and requests to the update domain fell 98%. The remaining 2% appeared to come from Android devices, which the researchers said continued to be at risk. Eye Security said it appeared no threat actors had discovered the vulnerability before the researchers took over the domain. It transferred ownership of that domain and 14 others to The Shadowserver Foundation and urged users to uninstall the app.