Skip to content
IIAIT

AI Today · 26 October 2026

Planted instruction files hijack AI coding agents, and Google links AI features to ad personalisation

Over the weekend: researchers show how a file dropped into the Downloads folder can steer AI coding agents, Google's updated privacy policy lets data shared with its AI features shape ads, Microsoft prepares AI phishing detection for Teams chats, and Moonshot releases Kimi K3.1 Pro.

  1. 01

    Instruction files planted in the Downloads folder can make AI coding agents run malicious code

    Forever Security says it found a malicious AGENTS.md file, disguised as engineering notes, in the Downloads folder of a customer's computer, where it had prompted a coding agent to try to install a harmful npm package called function-color. Coding agents automatically follow instruction files in the folder they are started in, and browsers such as Chrome, Edge and Firefox save downloads there without asking. In the researchers' tests, OpenAI Codex ran a harmless test payload in about 90% of attempts, and a planted CLAUDE.md file made Claude Code send its traffic to a server they controlled, exposing its login token, in about half of attempts. The researchers describe this as a design gap rather than a bug that can be patched, BleepingComputer reported on 25 October.

    What it means for you

    Do not start coding agents in your Downloads or home folder; open them only in the project they are meant to work on. Read any AGENTS.md or CLAUDE.md you did not write, keep approval prompts and sandboxing switched on, and if you find an unexpected server or proxy in an agent's settings, change the related passwords and tokens.

    Sources

  2. 02

    Google's privacy policy now allows data shared with its AI features to personalise ads, outside the EEA for now

    Google's privacy policy, effective 16 October, keeps its rule that ads are not personalised from content in Gmail, Drive or Google Photos, but adds an exception when users choose to make that data available to services that support personalised ads. The policy gives the example that Search may use data a user allows it to access to personalise content, including ads. This applies to Personal Intelligence, the opt-in feature that lets Gemini and Search draw on connected apps. The change drew wider attention on 24 October, when The Hacker News reported it. Google says Personal Intelligence is in beta for adults worldwide except the European Economic Area, Switzerland, the United Kingdom and Nigeria.

    What it means for you

    For personal Google accounts used in the EU, Personal Intelligence is not yet offered, so nothing changes today. If you or colleagues use personal accounts elsewhere, check which apps are connected to Gemini and Search. Do not connect a mailbox or drive that holds work or client data.

    Sources

  3. 03

    Microsoft Teams will use AI to flag phishing and impersonation in chats from November

    Microsoft is adding AI-based detection to Teams that looks at the context of a conversation to spot phishing, social engineering and impersonation, including messages that contain no malicious link or file, BleepingComputer reported on 23 October. It focuses mainly on first contact from people outside the organisation. Rollout to targeted-release customers is planned to start in early November and general availability worldwide from early to mid-December 2026. No admin action is needed to turn it on, and Microsoft says message content is not kept for model training or other secondary uses.

    What it means for you

    If your organisation uses Teams with external contacts, tell staff that warnings may start appearing in November and how to report a suspicious chat or a wrong warning. A warning helps, but the old rule still applies: confirm unusual payment or access requests through a second channel.

    Sources

  4. 04

    Moonshot releases Kimi K3.1 Pro with a 1 million token context and promises open weights by 4 November

    Moonshot AI released Kimi K3.1 Pro on 23 October, together with a faster Highspeed variant, in its Kimi apps and API. The company says the model handles up to 1 million tokens of context and reports benchmark results close to leading proprietary models on coding and office tasks; these are the company's own figures. Full model weights are due by 4 November 2026, and the licence has not yet been published. According to Simon Willison's review, API pricing is 2 US dollars per million input tokens and 10 US dollars per million output tokens.

    What it means for you

    Open-weight models of this size give organisations the option of running a capable model on infrastructure they choose, which can help with data protection. Before using the hosted service for work data, check where it is processed and on what terms, and wait for the licence before planning your own deployment.

    Sources