The Attack Surface AGENTS.md Standardized

One file, read by default, by design

AGENTS.md is an open format for giving coding agents project context: setup commands, code style, directory conventions. It emerged from a coalition of OpenAI Codex, Amp, Google Jules, Cursor, and Factory, and is now stewarded by the Agentic AI Foundation under the Linux Foundation. The file itself is plain Markdown with no required schema:

# AGENTS.md

## Setup commands
- Install deps: `pnpm install`
- Start dev server: `pnpm dev`
- Run tests: `pnpm test`

## Code style
- TypeScript strict mode
- Single quotes, no semicolons

The project's own site currently lists 23 tools that read it: Codex, Jules, Factory, Aider, goose, opencode, Zed, Warp, VS Code, Devin, UiPath's Autopilot and Coded Agents, JetBrains Junie, Amp, Cursor, RooCode, Gemini CLI, Kilo Code, Phoenix, Semgrep, GitHub Copilot, Ona, Windsurf, and Augment Code. Anthropic and Claude Code are not on that list. A closed GitHub issue asking Claude Code to read AGENTS.md natively went unaddressed, though CLAUDE.md can reference it with an @AGENTS.md line or a symlink.

The mechanism that matters is not which tools made the list. It's what "reads it" means in practice. Most of these tools do not treat AGENTS.md as reference material a model might consult. They load it into every request automatically and treat its contents as instructions the agent should follow, not documentation the agent might find useful.

The property that makes it useful is the property that makes it dangerous

Research cited by security researchers at Prompt Security, drawing on evaluation work out of ETH Zurich, found that agents follow AGENTS.md instructions faithfully: specifying a particular tool in the file measurably increases how often the agent reaches for that tool. That is the entire value proposition of the format working as intended. It is also, unmodified, a description of a successful prompt injection: content dropped into a workspace that reliably redirects agent behavior, loaded automatically, with no user action required to trigger it.

Three independent pieces of research from late 2025 through mid-2026 demonstrate what that looks like in practice.

Direct injection through a cloned repo

In December 2025, researchers at Prompt Security demonstrated the simplest version of the attack against VS Code's Copilot Chat, which injects AGENTS.md into every chat request by default. A developer clones a repository containing a plausible-looking AGENTS.md. They open the project and ask Copilot a routine question. The hidden directives in the file redirect the agent to scan the workspace for credentials and use available tools to send internal data to an external address. Nothing about the user's actual prompt asked for any of that. A follow-up writeup frames the distinction from ordinary prompt injection correctly: this isn't opportunistic content an attacker hopes the model happens to read, it's a structural, persistent instruction channel that fires on every interaction by design. The researchers classify it under OWASP's agentic threat taxonomy as ASI01 (agent goal hijack) combined with ASI02 (tool misuse).

Indirect injection through a dependency

NVIDIA's AI Red Team went a step further and demonstrated that an attacker doesn't need to touch the repository directly at all. In their proof of concept, a malicious Go dependency executes code during the build, detects that it's running inside a Codex environment by checking for the CODEX_PROXY_CERT environment variable, and writes a crafted AGENTS.md to the project on the fly. The injected file's directives claim "absolute authority" that supersedes the user's actual requests, and separately instruct the agent to keep the changes out of PR summaries and commit messages. The demonstrated payload was a five-minute sleep delay quietly added to a Go program, with the agent cooperating in hiding its own edit from review. Nobody wrote or reviewed that AGENTS.md file. It didn't exist until a dependency's build step created it.

Structural exposure in CI/CD

A third research effort, GitInject, tested AI agents wired into GitHub Actions workflows against real, ephemeral repositories rather than simulations, across four AI providers. These agents process untrusted content (pull request titles, descriptions, code, comments) while holding elevated repository permissions to do their job. Every provider tested was vulnerable in its default configuration, across eleven documented attack classes including config-file injection and credential exfiltration. The paper's own framing of the result is worth repeating directly: "the most critical vulnerabilities are structural: they arise from how CI/CD infrastructure handles credentials and configuration files, not from any specific model's behavior."

Why the usual advice doesn't close the gap

The mitigations that show up across this research are reasonable as far as they go: review AGENTS.md with the same rigor as a shell script, scope agent permissions narrowly, pin dependency versions, watch for unexpected file changes. NVIDIA's own list includes "limit what files AI agents can read and write" and "set up alerts for unexpected modifications."

Read closely, that list is really describing controls that have to live outside the process the agent is running in to mean anything. Reviewing AGENTS.md by hand doesn't help when a build-time dependency writes it after review has already happened. Scoping permissions inside the agent's own configuration doesn't help when the thing overriding that scope is a paragraph in context claiming "absolute authority," because a permission rule expressed as text the model reads is competing with other text the model reads, on the model's terms, not the runtime's.

GitInject's framing is the clean version of this: the vulnerability is structural, not a matter of which model is running or how carefully one AGENTS.md file was worded. A file that gets loaded automatically, treated as authoritative, and can be rewritten by anything with build-time code execution cannot itself be the place a security boundary lives. The boundary has to sit at the point where the agent's actions actually leave the process, the network call, the credential read, the file write, somewhere a rewritten AGENTS.md has no path to reach. An allowlist enforced between the agent and the network doesn't care whether the context window contains a paragraph asserting absolute authority. It checks whether the destination is on the list.