● Targets: OpenAI Codex and Claude Code
● Vector: AGENTS.md, read from the repository
● Reported success: 90% in a harmless Codex demo, controlled conditions
● Practical read: a PR touching AGENTS.md is a code path, not documentation
Researchers demonstrated prompt injection against OpenAI Codex and Claude Code using AGENTS.md - the instruction file both agents read out of a repository. In a harmless demonstration against Codex they reported a 90% success rate, under controlled laboratory conditions.
The mechanism is the obvious one once stated: an agent that reads a file from the repository it is working in will follow instructions in that file. A pull request that adds or edits AGENTS.md is therefore a code path, not documentation, and it reaches the agent before any human reviews the diff.
The 90% figure is a lab number and should be read as such. The structural point survives it: if your agent trusts repository files, then anyone who can open a pull request can address your agent directly.
Sources
Tech Startups daily brief.