翻訳待ち：A Go dependency wrote AGENTS.md mid-build and got Codex to hide the change

AI サービスが一時的に利用できないため、復旧後に翻訳を補完します。

In a proof of concept published in mid-2026, NVIDIA's AI Red Team planted a malicious dependency in a Go project, let it execute during a normal build, and watched it write a new AGENTS.md file into the project directory. The file's directives told the coding agent that its instructions carried "absolute authority" over anything the user asked, and separately told it to keep the change out of PR summaries and commit messages. The agent complied. Nobody wrote or reviewed that AGENTS.md. It did not exist until a dependency's build step created it, mid-session, with no human in the loop. That is not a bug in one tool's implementation. AGENTS.md is an open format, now read automatically by more than twenty coding tools, that works by loading a file's contents into every request and treating them as instructions the agent should follow. That is also, unmodified, the description of a working prompt injection: content an attacker can place in a workspace that reliably redirects agent behavior, with no user action required to trigger it. Three independent research efforts from December 2025 through mid-2026 demonstrate what that looks like in practice: through a build-time dependency, through a cloned repo, and through a CI/CD pipeline. The build-time attack NVIDIA's proof of concept is the sharpest of the three because it does not require an attacker to touch the target repository at all. A malicious Go dependency, already present in the project's dependency tree, executes code during the build and detects that it is running inside a Codex environment by checking for the CODEX_PROXY_CERT environment variable. It then writes a crafted AGENTS.md into the project. The injected directives claim "absolute authority" that supersedes the user's actual requests, and instruct the agent to keep its changes out of PR summaries and commit messages. The demonstrated payload was a five-minute sleep delay quietly added to a Go program, with the agent cooperating in hiding its own edit from review. Two more ways the same mechanism gets exploited | Research | Attack vector | Target | Outcome | |----------|---------------|--------|---------| | NVIDIA AI Red Team, 2026 | Dependency writes AGENTS.md at build time | OpenAI Codex | Agent obeyed an "absolute authority" directive and hid a change from review | | Prompt Security, December 2025 | Cloned repo ships a malicious AGENTS.md | VS Code Copilot Chat | Agent scanned the workspace for credentials and exfiltrated data during a routine chat request | | GitInject, 2026 | Untrusted PR content processed with elevated repo permissions | 4 AI providers in GitHub Actions | Every provider vulnerable by default, across 11 documented attack classes | Prompt Security's demonstration, from December 2025, is the more direct version: a developer clones a repository containing a plausible-looking AGENTS.md, opens the project, and asks Copilot a routine question. VS Code injects the file into every chat request by default. The hidden directives redirect the agent to scan the workspace for credentials and use available tools to send internal data to an external address. Nothing about the user's actual prompt asked for any of that. A follow-up analysis classifies it under OWASP's agentic threat taxonomy as ASI01 (agent goal hijack) combined with ASI02 (tool misuse). It also draws the useful distinction from ordinary prompt injection: this is not opportunistic content an attacker hopes the model happens to read. It is a structural, persistent instruction channel that fires on every interaction by design. The third finding, GitInject, tested AI agents wired into GitHub Actions workflows against real, ephemeral repositories rather than simulations, across four AI providers. These agents process untrusted content (pull request titles, descriptions, code, comments) while holding elevated repository permissions to do their job. The paper's own framing is worth repeating directly: "the most critical vulnerabilities are structural: they arise from how CI/CD infrastructure handles credentials and configuration files, not from any specific model's behavior." Why the format spread this fast Research cited by Prompt Security, drawing on evaluation work out of ETH Zurich, found that agents follow AGENTS.md instructions faithfully: specifying a particular tool in the file measurably increases how often the agent reaches for that tool. That reliability is the entire value proposition of the format working as intended, and it is why adoption moved quickly. AGENTS.md emerged from a coalition of OpenAI Codex, Amp, Google Jules, Cursor, and Factory. As of August 2026, it is stewarded by the Agentic AI Foundation under the Linux Foundation. The project's own site lists 23 tools that read it: Codex, Jules, Factory, Aider, goose, opencode, Zed, Warp, VS Code, Devin, UiPath's Autopilot and Coded Agents, JetBrains Junie, Amp, Cursor, RooCode, Gemini CLI, Kilo Code, Phoenix, Semgrep, GitHub Copilot, Ona, Windsurf, and Augment Code. Anthropic and Claude Code are notably absent from that list. A GitHub issue asking Claude Code to read AGENTS.md natively was closed without a maintainer response, though CLAUDE.md can reference it with an @AGENTS.md line or a symlink. That gap does not change the underlying finding: whichever file a given tool loads automatically and trusts by default carries the same exposure. Why the usual advice doesn't close the gap The mitigations that show up across this research are reasonable as far as they go: review AGENTS.md with the same rigor as a shell script, scope agent permissions narrowly, pin dependency versions, watch for unexpected file changes. NVIDIA's own list includes "limit what files AI agents can read and write" and "set up alerts for unexpected modifications." Read closely, that list describes controls that have to live outside the process the agent is running in to mean anything. Reviewing AGENTS.md by hand doesn't help when a build-time dependency writes it after review has already happened. Scoping permissions inside the agent's own configuration doesn't help when the thing overriding that scope is a paragraph in context claiming "absolute authority," because a permission rule expressed as text the model reads is competing with other text the model reads, on the model's terms, not the runtime's. GitInject's framing is the clean version of this: the vulnerability is structural, not a matter of which model is running or how carefully one AGENTS.md file was worded. A file that gets loaded automatically, treated as authoritative, and can be rewritten by anything with build-time code execution cannot itself be the place a security boundary lives. The boundary has to sit at the point where the agent's actions actually cross onto the network, somewhere a rewritten AGENTS.md has no path to reach. Two checks at that point cover most of what the model's own judgment can't be trusted to enforce: does this outbound content contain something that looks like a secret, and is this destination one the workspace actually allows. Neither check reads the paragraph in context asserting absolute authority. Both just read the traffic.