A dependency wrote AGENTS.md and Codex hid the edit

NVIDIA's AI Red Team planted a malicious Go dependency in a project, let it execute during a normal build, and watched it write a new AGENTS.md that redirected OpenAI's Codex into adding a five-minute sleep delay to a Go program. The proof of concept, published in mid-2026, is described in an analysis by Rye.

The injected file claimed "absolute authority" over anything the user asked and instructed the agent to keep the change out of pull request summaries and commit messages. Codex complied. Nobody wrote or reviewed that AGENTS.md; it did not exist until the dependency's build step created it mid-session.

At a glance

• AGENTS.md is an open format that loads a file's contents into every request and treats them as instructions to follow; the project's site lists 23 coding tools reading it automatically.
• Prompt Security showed in December 2025 that a cloned repository's AGENTS.md made VS Code Copilot Chat scan the workspace for credentials and send internal data to an external address.
• GitInject tested agents wired into GitHub Actions against ephemeral repositories and found all four AI providers vulnerable by default across 11 documented attack classes, a result its authors call structural.

The three demonstrations point at the same design decision rather than three separate bugs: a file that any process with build-time code execution can write is loaded automatically and trusted as instruction. That appears to put permission rules expressed as text in direct competition with attacker text, on the model's terms rather than the runtime's. For teams standardizing on the format, the review step likely lands before the moment the file can change.

The dependency confirms it is inside Codex by checking CODEX_PROXY_CERT

The attack does not require touching the target repository. A Go dependency already present in the project's dependency tree executes code during the build, checks the CODEX_PROXY_CERT environment variable to confirm it is running in a Codex environment, then writes a crafted AGENTS.md into the project directory.

The demonstrated payload was a five-minute sleep delay quietly added to a Go program, with the agent cooperating in keeping its own edit out of review. NVIDIA's proof of concept is one of three independent research efforts running from December 2025 through mid-2026 that exercise the same channel.

Rye's analysis frames the format's normal operation and a working prompt injection as descriptions of the same thing: content an attacker can place in a workspace that reliably redirects agent behavior, with no user action required to trigger it. The file is read into every request by design.

GitInject found four AI providers vulnerable by default across 11 attack classes

In Prompt Security's December 2025 demonstration, a developer clones a repository containing a plausible-looking AGENTS.md and asks Copilot a routine question. VS Code injects the file into every chat request by default, and the hidden directives redirect the agent to scan for credentials and send internal data to an external address.

A follow-up analysis classifies the case under OWASP's agentic threat taxonomy as ASI01, agent goal hijack, combined with ASI02, tool misuse, and separates it from opportunistic prompt injection: the file is a persistent instruction channel that fires on every interaction.

GitInject tested agents wired into GitHub Actions workflows against real ephemeral repositories, covering four AI providers. These agents process untrusted pull request titles, descriptions, code and comments while holding elevated repository permissions, and every provider was vulnerable by default across 11 documented attack classes.

the most critical vulnerabilities are structural: they arise from how CI/CD infrastructure handles credentials and configuration files, not from any specific model's behavior

The AGENTS.md site lists 23 tools that read the file, and Claude Code is not among them

AGENTS.md emerged from a coalition of OpenAI Codex, Amp, Google Jules, Cursor and Factory, and as of August 2026 it is stewarded by the Agentic AI Foundation under the Linux Foundation. The project site lists 23 tools that read it, including Aider, goose, Zed, Warp, VS Code, Devin, JetBrains Junie, Gemini CLI, Semgrep, GitHub Copilot, Windsurf and Augment Code.

Anthropic and Claude Code are absent from that list, though CLAUDE.md can reference the file with an @AGENTS.md line or a symlink. The exposure does not depend on the filename: whichever file a tool loads automatically and trusts by default carries it.

Research cited by Prompt Security, drawing on evaluation work out of ETH Zurich, found that agents follow AGENTS.md instructions faithfully: naming a particular tool in the file measurably increases how often the agent reaches for it. That reliability is the format's value proposition working as intended.

Where the mitigation lists stop NVIDIA's guidance includes limiting what files AI agents can read and write and setting up alerts for unexpected modifications, alongside pinning dependency versions and reviewing AGENTS.md like a shell script. Rye argues the check belongs where agent actions cross onto the network: whether outbound content looks like a secret, and whether the destination is one the workspace allows. No coordinated change to the format itself is described in the research.