In March, The Instruction Illusion argued that configuration files cannot govern agent behavior.
Instructions tell an agent what to do. Governance controls what an agent is able to do. Conflating the two produces agents with instructions and no boundary. Four months on, both major coding-agent vendors say the same thing in their own documentation — and they have shipped the boundary. What has not happened is the part this dispatch is about.
The file became an institution
AGENTS.md is a Markdown file beside a project’s README that gives coding agents project-specific instructions: build commands, test invocations, conventions, security notes. OpenAI released it in August 2025 and donated it to the Agentic AI Foundation, formed under the Linux Foundation on December 9, 2025 — where it sits alongside Anthropic’s MCP and Block’s goose as one of three founding contributions. At that announcement the Linux Foundation reported adoption across more than sixty thousand open-source projects, and support from Codex, Cursor, Copilot, Devin, Jules, Gemini CLI, VS Code, and others.
Its own documentation is precise about what it is: a README for agents. The founding announcement is equally precise, and says something different — describing AGENTS.md as a simple, universal standard giving coding agents a consistent source of project-specific guidance.
That is the drift, stated at the moment of institutionalization. The format calls itself a README. The body that took stewardship of it calls it a standard. Both sentences are public. Only one of them is a claim about trust.
Four sentences from the format’s FAQ describe the entire architecture. The agent parses the text you provide; there are no required fields. The closest AGENTS.md to the edited file wins. Explicit chat prompts override everything. And the agent will attempt the programmatic checks you list, and fix failures, before finishing the task.
That is a precedence hierarchy resolved by directory position, and an execution path opened by Markdown. No signature. No version. No issuer. Nothing in the file is a claim that anything could verify — the same wall the Agent Registry Teardown found in every descriptor format it scored, reached here without even a notarization step to fail at.
And yet the format’s own guidance lists security considerations among the sections a repository should cover in the file. That single line is the drift, documented in the primary source. A file with no issuer and no enforcement property is being recommended as a place to write security posture — while both vendors that read it route security enforcement somewhere else entirely, as their documentation will show.
Directory proximity is not authority
Nesting is what makes this structural rather than merely loose. An AGENTS.md can sit in every package of a monorepo; the format’s site cites OpenAI’s main repository as carrying eighty-eight of them, with the nearest file to the code being edited taking precedence.
So the question who may instruct this agent is answered by where the file sits in the tree.
The authorization boundary collapses onto write access to the working directory — every path, every vendored dependency, every build step that runs before the agent starts. Set against SACS: the Source is a file, the Action is executable, the Context is nearest-ancestor resolution, and the Scope is whatever the runtime already granted. Four axes, none of them bound.
The red team ran it
In April 2026, NVIDIA’s AI Red Team published a disclosed attack against Codex that exercises exactly that surface. A malicious Go dependency, detecting a Codex environment by an environment variable, writes an AGENTS.md into the working directory during go mod tidy. The injected file directs the agent to insert a five-minute sleep into any main function; to say nothing of it in reasoning, summaries, commit messages, or pull-request descriptions; and to leave a code comment instructing the downstream summarizing agent to do the same. It asserts absolute precedence over the user’s own prompt. The agent complied. The pull request looked clean.
NVIDIA’s characterization of the trust model is the sentence this dispatch exists to sit with: these instructions are treated as trusted context by the agent, and that trust model is by design.
Coordinated disclosure ran from July to August 2025 and closed with OpenAI concluding that the attack does not significantly elevate risk beyond what a compromised dependency already achieves, and that no changes were planned. NVIDIA calls that a fair assessment. On the plane being assessed, it is. The attacker already had code execution; no new execution was granted.
But the exposure is on a different plane. The dependency did not gain the ability to run. It gained the ability to instruct — to redefine the agent’s objective, discard the user’s request, and shape what the record would later say about both.
The finding is not that the file is a novel exploit. It is that the file is a trusted input with no issuer. The prior literature reached the same place from the other direction: rules files are an ideal persistence target precisely because the agent seeks them out, and OWASP has held since 2025 that a model cannot reliably separate instruction from data. Standardizing the filename does not narrow that surface. It publishes the target’s name across the ecosystem and guarantees the agent will go looking.
Both vendors drew the line. In writing.
Here is what has changed since March, and it is worth saying plainly: the vendors are not the gap. They documented the boundary, and they built it.
Anthropic’s current Claude Code documentation states that CLAUDE.md files and auto memory are loaded into every session and that Claude treats them as context, not enforced configuration — and directs anyone who needs to block an action regardless of what Claude decides to a PreToolUse hook instead. It goes further. CLAUDE.md content is delivered as a user message after the system prompt, not as part of it, with no guarantee of strict compliance. In the large-team section, the split is a table: tool, command, and path blocking and sandbox isolation belong in managed settings; code style, compliance reminders, and behavioral instructions belong in a managed CLAUDE.md. The stated reason is the entire thesis of the corpus, in the vendor’s own words — settings rules are enforced by the client regardless of what Claude decides to do, while CLAUDE.md instructions shape behavior but are not a hard enforcement layer.
OpenAI draws the same line for Codex, with equal candor about where its gate currently reaches. Codex composes an OS-enforced sandbox defining what the agent can technically do with an approval policy defining when it must stop and ask, and layers lifecycle hooks — SessionStart, UserPromptSubmit, PreToolUse, PostToolUse, Stop — next to those controls. The hooks documentation marks the feature experimental and states its coverage limits directly: PreToolUse currently intercepts only Bash; the model can route around it by writing a script to disk and executing that; it does not intercept MCP, Write, WebSearch, or other non-shell tool calls; and several decision fields are parsed but not yet supported, so they fail open. OpenAI’s own instruction: treat it as a useful guardrail rather than a complete enforcement boundary.
Read those two documentation sets together and the architecture is unambiguous, and it is shared. The instruction file is context. Enforcement lives at tool-call interception, OS-level sandboxing, approval policy, and managed configuration the local user cannot override. Neither vendor claims otherwise. Neither ever did.
Where the trust boundary actually sits
Which surfaces the finding.
Both vendors built a trust boundary. Both drew it around config — and neither drew it around the instruction file.
Codex resolves project configuration from the project root down to the working directory, closest wins, and only for trusted projects. Mark a project untrusted and Codex skips the project-scoped .codex/ layers entirely: project-local config, hooks, and rules. Managed machines can constrain further through requirements.toml, and administrators can require that only managed hooks load. Anthropic ships the symmetric control: claudeMdExcludes exists specifically to skip CLAUDE.md files from other teams in a large monorepo, and managed-policy CLAUDE.md cannot be excluded by individual settings, so organization-wide instructions always apply.
Every one of those controls governs a file the enterprise deliberately installed. None of them governs the file a dependency writes into the working directory at build time. AGENTS.md does not live in .codex/. It is not config. It is not a hook. It is not a rule. It sits outside every trust gate either vendor has documented — and it is read anyway, first, by design, at the top of the loop.
That is what NVIDIA found. Not a flaw in a hook, or a hole in a sandbox. A file that no trust boundary is drawn around, doing the one thing no boundary was watching for: talking.
The hard claim
The industry standardized the instruction file and did not standardize the trust boundary around it. Enforcement was built — well, and in the open, by both vendors, with the coverage limits stated. Provenance was not. Tens of thousands of repositories carry a filename that every major coding agent knows to look for, and no property of that file answers who wrote this, and were they allowed to.
An enterprise that has standardized on AGENTS.md has standardized how it tells its agents things. It has not, by that act, acquired any means of knowing what its agents were actually told.
The Instruction Illusion said the harness is the enforcement surface, not the file. Both vendors now say so in their docs, and both have shipped the harness.
The format answers what to tell an agent. It does not answer who is permitted to tell it. Until a version, an issuer, and a signature are properties of the file rather than properties of the directory it happens to sit in, standardizing the instruction layer standardizes the target.
