By NHI Mgmt Group Editorial TeamBased on Backslash Security: “OpenAI Codex injection in AGENTS.md: Exfiltrating Credentials via Trusted Configuration Execution” (July 6, 2026)

TL;DR: OpenAI Codex CLI in non-interactive exec mode can silently execute attacker-controlled instructions embedded in AGENTS.md before processing the user’s task, enabling credential reads and staging from local paths such as AWS keys or npm tokens, according to Backslash Security. The core issue is that safety gating becomes mode-dependent, not invariant, so agent instruction files now function as executable supply chain artifacts.

At a glance

What this is: This is a Backslash Security analysis showing that AGENTS.md can become a hidden execution channel for coding agents when exec mode treats project instructions as trusted input.

Why it matters: IAM and platform teams need to treat agent instruction files as governed execution surfaces because unsupervised coding agents can turn a repository clone into credential exposure and supply chain risk.

Context

AGENTS.md is a project-level instruction file that coding agents read before completing a task. When that file is treated as trusted configuration, it can become a control boundary rather than just documentation, especially when the agent has filesystem access and can run shell commands.

The issue here is not prompt injection in the abstract. It is the combination of unsupervised execution, repository-trusted instructions, and read access to local credential paths such as AWS keys, npm tokens, and other developer secrets. In practice, that makes agent instruction files part of the identity and secrets governance surface.

Backslash Security’s finding applies most directly to autonomous coding agents running in CI/CD or other hands-off contexts. That is an atypical but increasingly important operating model, and it breaks assumptions that were built for interactive tooling.

Key questions

Q: What breaks when AGENTS.md is treated as trusted input for coding agents?

A: The control boundary breaks because the agent can execute repository instructions before the user task and without a separate human approval step. That turns a file meant for project guidance into an instruction channel with the same practical effect as code execution. Security teams should treat that file as untrusted until reviewed and policy-cleared.

Q: Why does exec mode create more risk than interactive agent use?

A: Exec mode removes the approval gate that would otherwise interrupt unexpected shell commands. That means a malicious instruction can run silently, while interactive mode at least gives the operator a chance to stop it. The risk is not the command alone, but the absence of a human-in-the-loop control at the point of execution.

Q: How should teams reduce secret exposure from autonomous coding agents?

A: They should combine filesystem isolation with secret-path restrictions and repository review. The practical objective is to stop the agent from reading credential locations such as AWS config, npm tokens, or Git credentials unless the workflow explicitly requires those reads. Without that boundary, ordinary task execution can become secret staging.

Q: What should organisations do first when they want to use unattended coding agents safely?

A: Start by limiting unattended execution to repositories and workflows that have passed content review, then put policy controls around the files that steer agent behaviour. That sequencing matters because trust in the repository has to be established before the agent is allowed to act on it. Otherwise, the automation inherits attacker-controlled instructions as routine setup.

Technical breakdown

Why AGENTS.md becomes an execution boundary

AGENTS.md is loaded as task-scoped configuration, but in exec mode the agent does not merely parse it for context. It follows instructions before handling the user request, which means the file can carry executable pre-task behaviour. That is materially different from a normal repo note or style guide because the file is consumed by the agent’s runtime decision path. Once the file is treated as trusted input, attacker-controlled instructions inherit the agent’s privileges and filesystem reach. The security question is therefore not whether the file is readable, but whether its contents can influence execution without a separate trust check.

Practical implication: classify agent instruction files as executable inputs and review them with the same discipline you apply to build scripts and CI definitions.

Why exec mode changes the threat model

Interactive mode inserts a human approval gate before shell commands run, but exec mode removes that gate to support hands-off automation. That means the same instruction file can be harmless in one mode and dangerous in another because the enforcement point changes. The key weakness is mode-dependent safety gating: the model may still recognise suspicious content, but recognition is not the same as prevention. For governance, this means the control objective is no longer just content safety. It is ensuring that execution mode and trust context are coupled, so an unreviewed repository cannot inherit privileged local execution by default.

Practical implication: tie exec-mode use to reviewed repositories and restrict it from ad hoc developer clones or other untrusted codebases.

How credential staging turns local access into supply chain risk

The article shows a simple but effective pattern: a malicious instruction can copy local secrets to a staging path during an otherwise routine command. Because workspace-write sandboxes often allow reads, the agent can access files such as ~/.aws/credentials, ~/.gitconfig, or ~/.npmrc even when write access is constrained. That makes the blast radius bigger than the immediate repository. The agent is not just executing bad code, it is using the developer’s ambient identity to reach secrets that were never meant for the repository. This is a supply chain problem because the attacker only needs to influence project content, not compromise the endpoint first.

Practical implication: isolate agent processes from credential paths and treat repository content as untrusted until policy checks pass.

Threat narrative

Attacker objective: The attacker wants to convert trusted repository configuration into silent access to developer credentials and downstream cloud or package-supply-chain compromise.

  1. Entry occurs when an attacker commits a malicious AGENTS.md file to a public or shared repository, or when another process writes attacker-controlled content into that file.
  2. Credential access happens when the coding agent in exec mode silently follows the injected pre-task instruction and reads local files such as AWS keys, npm tokens, or other secrets.
  3. Impact follows when the staged credentials are used for further access, package publishing, or cloud compromise, while the victim sees a normal task completion.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AGENTS.md has become an execution boundary, not a documentation boundary. Backslash Security’s finding shows that project instruction files can inherit the agent’s runtime privileges when the file is consumed before the user task. That changes repository hygiene from a code-review concern into a governance control over what the agent is allowed to execute. The practical conclusion is that agent instruction files now belong in the same trust class as build scripts and pipeline definitions.

Mode-dependent safety is a broken assumption for agent governance. Interactive approval and exec mode do not represent the same control state, so a control that works under one mode can disappear under another. That assumption was designed for tools whose execution path is stable. It fails when the actor can switch from gated to ungated execution, because the trust boundary no longer lives inside the content itself. Practitioners need to treat execution mode as part of the control plane, not a user preference.

Credential exposure is the symptom, but the deeper problem is ambient identity reach. The attack works because the coding agent runs with the developer’s local identity and filesystem access. That means the real asset is not just the secret file, but the implicit privilege to read it during routine execution. The programme implication is that IAM, endpoint policy, and agent governance now overlap in one control surface.

Static review of code is no longer enough when non-code files can drive execution. This case makes AGENTS.md, MCP configuration, and similar agent instructions part of the software supply chain. Security teams need to recognise that the trust model now spans text files that can alter behaviour without ever becoming source code changes. That widens the audit boundary for NHI and agentic systems at the same time.

Trust-boundary drift is the right named concept for this risk. The boundary between harmless project metadata and executable instructions moves when an agent is authorised to follow repo-local directions automatically. Once that boundary drifts, controls built on manual review or human approval become brittle because the agent reads trust from location and mode, not from intent. Practitioners should treat that drift as a governance defect, not just a prompt-injection bug.

From our research library:

What this signals

Trust-boundary drift: agent instruction files now sit on the boundary between documentation and execution, so organisations need to govern them as part of the software supply chain, not as harmless project metadata.

Approval-free agent modes should be constrained to trusted repositories only. Once a coding agent can read local secrets and obey repo-local instructions, repository trust becomes an IAM and endpoint control problem, not just a developer workflow issue.

For practitioners

  • Audit agent instruction files as executable artifacts Review AGENTS.md, MCP server configuration, and similar files for shell commands, file reads, outbound requests, and obfuscated instructions before allowing them in automation.
  • Block exec mode on unreviewed repositories Require content review and policy clearance before running non-interactive agent modes against repositories you did not author or that have not passed a trust check.
  • Restrict filesystem reach for agent processes Prevent coding agents from reading credential paths such as ~/.aws, ~/.gitconfig, and ~/.npmrc unless those paths are explicitly required for the task.
  • Separate interactive and unattended use cases Reserve approval-free execution for tightly controlled automation contexts and keep cloned or unfamiliar repositories in an approval-gated workflow.
  • Monitor for repository-driven secret access Log and alert on agent reads of secret stores, staging directories, and unexpected shell invocations so file-based instruction abuse becomes visible.

Key takeaways

  • AGENTS.md can alter a coding agent’s behaviour before the user task begins, which makes the file part of the execution surface.
  • The article’s proof of concept shows silent command execution and credential staging from local paths, including AWS keys and npm tokens.
  • The practical control is to treat agent instruction files as untrusted supply chain artifacts and restrict unattended execution to reviewed contexts.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and CSA Cloud Controls Matrix set the governance and control requirements practitioners need to meet.

FrameworkControl / ReferenceRelevance
OWASP Agentic AI Top 10ASI03 — Identity & Privilege AbuseThe article shows a coding agent using inherited privileges to execute attacker-controlled instructions.
ASI09 — Human-Agent Trust ExploitationAGENTS.md abuse depends on the agent treating project content as trusted operational guidance.
Recommendation — Limit agent privileges and separate trusted execution from repository-controlled instructions. Treat repository-local instructions as untrusted until they pass review and policy checks.
OWASP Non-Human Identity Top 10NHI-02 — Secret LeakageThe attack stages local credentials by abusing the agent’s read access to secret paths.
NHI-10 — Human Use of NHIThe agent runs with ambient developer identity and can act on behalf of the user in unsafe ways.
Recommendation — Restrict access to credential paths and alert on unexpected secret reads by agent processes. Separate human approval from machine execution whenever a coding agent can touch sensitive paths.
MITRE ATT&CKTA0006;TA0008 — Credential Access; Lateral MovementThe technique chain includes secret collection followed by downstream access paths using those secrets.
Recommendation — Map agent-driven secret reads to credential access and hunt for follow-on use across environments.
NIST SP 800-53 Rev 5IA-5 — Authenticator ManagementThe article centers on exposure and misuse of local authenticators and tokens during agent execution.
Recommendation — Apply authenticator lifecycle controls to reduce the value and reach of exposed secrets.
CSA Cloud Controls MatrixIAM — Identity and Access ManagementThe risk is governed by who and what the agent can access during repository-driven execution.
Recommendation — Define agent identity and access boundaries for every unattended execution context.

Key terms

  • Agent Instruction File: An agent instruction file is the persistent set of standing directions an AI agent reads across sessions, often covering purpose, conventions, and allowed actions. Because it shapes every run, it should be lean, structured, and versioned. Overloaded instruction files create reliability and governance problems.
  • Exec mode: An agent execution mode that removes the per-command approval prompt and allows tasks to run without human intervention. For autonomous coding agents, this mode increases the importance of external policy enforcement because the runtime can act before a person sees the command.
  • Trust Boundary Drift: Trust boundary drift is the gradual shift of where users and systems decide something is legitimate. In fraud and identity environments, that boundary can move from checkout to search, ads, or account recovery, which creates new opportunities for impersonation and abuse.
  • Ambient Identity Reach: The set of local files, tokens, and services a process can access because it runs with a user’s inherited identity. For autonomous coding agents, this matters because routine task execution can expose secrets that were never intended for the repository workflow.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
NHIMG Editorial Note
Published by the NHIMG editorial team on July 9, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org