Indirect AGENTS.md injection is an attack on a coding agent that reaches the agent through a project configuration file rather than through its prompt. Code executing in the environment where the agent works — in the case that named the technique, a malicious dependency running during the build — writes an AGENTS.md file, and the agent loads it as trusted project context and acts on the instructions it contains. It is a form of Indirect Prompt Injection specialized to the files agents treat as their own configuration, and it turns a supply chain compromise into control over the agent rather than only over the code.
Usage
The technique depends on a property of agent instruction files that is deliberate rather than accidental: they exist to carry project conventions into the agent’s context, so the agent is built to treat them as trusted. An attacker who can write into the working tree can therefore supply instructions that arrive with the standing of project configuration.
The demonstrated form has three stages. First, code that already has execution in the build environment detects that it is running under an agent — in the reported case by checking for an environment variable specific to that agent’s container — so the payload stays dormant in ordinary developer environments. Second, it writes an instruction file whose directives claim precedence over the user’s prompt and the agent’s own knowledge, specifying both a change to make and an instruction to make it silently. Third, concealment is chained forward: because a pull request is often summarized by another model, a comment left in the generated code can address that summarizer directly and ask it to omit the change, so the modification is missing from the commit message, the pull request description and the agent’s own summary. The result reaching a human reviewer looks like the change they asked for.
What is distinctive is the target. A classical supply chain attack injects malicious code; this redirects the agent, which then writes the code itself and reports on its own work. The consequences described include performance degradation or denial of service from an injected delay, and the possibility of reaching code execution inside continuous integration through checks that run on pull requests.
When It Applies
It applies where an agent loads instruction files from a working tree that untrusted code can write to, and where a build or setup step executes dependency code before or during the agent’s task. Its central precondition is the one that bounds its severity: the attacker must already have code execution in that environment. In the reported case this came from a compromised dependency, and the vendor’s assessment of the disclosure was that the attack did not significantly elevate risk beyond what a compromised dependency already permits — the researchers accepted that as a fair reading while arguing the agentic dimension is a new one.
The assumptions are worth stating separately, because each is a place the attack fails. It assumes the instruction file is picked up without provenance checks — an untracked file appearing mid-build is loaded the same as one committed to the repository. It assumes the agent resolves a conflict between file-level directives and the user’s request in favour of the file. And the concealment stage assumes the reviewer’s account of the change is itself produced by a model reading attacker-influenced text, rather than by reading the diff.
The countermeasures named follow those assumptions rather than the payload: pinning exact dependency versions and scanning packages before use, limiting which files an agent may read and write and enforcing integrity controls on configuration files specifically, alerting on unexpected file modifications, and auditing agent-generated pull requests with dedicated security agents instead of relying on human review alone. Its standing is a single vendor red team’s demonstration on a constructed scenario, disclosed to the affected vendor and published with the disclosure timeline; it is not a measured rate of exploitation in the wild.
Related Terms
Indirect Prompt Injection, Prompt injection, AGENTS.md, Tool Poisoning, OpenAI Codex, Mitigating Indirect AGENTS.md Injection Attacks in Agentic Environments