August 19, 2026 · 6 min read
A Go dependency wrote AGENTS.md mid-build and got Codex to hide the change
A malicious Go dependency wrote a fake AGENTS.md into a project mid-build, told the coding agent its instructions carried 'absolute authority,' and got it to hide a change from code review, one of three 2025-2026 findings that AGENTS.md's automatic-trust design works as an injection vector.