Topic starter
09/07/2026 3:22 pm
TL;DR: OpenAI Codex CLI in non-interactive exec mode can silently execute attacker-controlled instructions embedded in AGENTS.md before processing the user’s task, enabling credential reads and staging from local paths such as AWS keys or npm tokens, according to Backslash Security. The core issue is that safety gating becomes mode-dependent, not invariant, so agent instruction files now function as executable supply chain artifacts.
Editorial analysis by NHI Mgmt Group, based on content published by Backslash Security: “OpenAI Codex injection in AGENTS.md: Exfiltrating Credentials via Trusted Configuration Execution”.
Key questions
Q: What breaks when AGENTS.md is treated as trusted input for coding agents?
A: The control boundary breaks because the agent can execute repository instructions before the user task and without a separate human approval step.
Q: Why does exec mode create more risk than interactive agent use?
A: Exec mode removes the approval gate that would otherwise interrupt unexpected shell commands.
Q: How should teams reduce secret exposure from autonomous coding agents?
A: They should combine filesystem isolation with secret-path restrictions and repository review.
Practitioner guidance
- Audit agent instruction files as executable artifacts Review AGENTS.md, MCP server configuration, and similar files for shell commands, file reads, outbound requests, and obfuscated instructions before allowing them in automation.
- Block exec mode on unreviewed repositories Require content review and policy clearance before running non-interactive agent modes against repositories you did not author or that have not passed a trust check.
- Restrict filesystem reach for agent processes Prevent coding agents from reading credential paths such as ~/.aws, ~/.gitconfig, and ~/.npmrc unless those paths are explicitly required for the task.
Bottom line: AGENTS.md can alter a coding agent’s behaviour before the user task begins, which makes the file part of the execution surface.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 3:40 pm
AGENTS.md has become an execution boundary, not a documentation boundary. Backslash Security’s finding shows that project instruction files can inherit the agent’s runtime privileges when the file is consumed before the user task. That changes repository hygiene from a code-review concern into a governance control over what the agent is allowed to execute. The practical conclusion is that agent instruction files now belong in the same trust class as build scripts and pipeline definitions.
A few things that frame the scale:
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What should organisations do first when they want to use unattended coding agents safely?
A: Start by limiting unattended execution to repositories and workflows that have passed content review, then put policy controls around the files that steer agent behaviour. That sequencing matters because trust in the repository has to be established before the agent is allowed to act on it. Otherwise, the automation inherits attacker-controlled instructions as routine setup.
👉 Read our full editorial: Codex exec mode shows how AGENTS.md becomes a trust boundary