The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Treat repository content as information to evaluate, not as authority to change the task. A pull request can carry prompt injection in source files, documentation, commit messages, screenshots, and even agent instruction files such as AGENTS.md. Keep the instruction hierarchy explicit, narrow the agent’s permissions, and review consequential changes. These controls reduce risk; they do not guarantee that prompt injection can be eliminated.
Can an AGENTS.md file override your instructions?
No. An AGENTS.md file can provide operational guidance for work in the part of a repository where it applies, but it does not outrank direct system, developer, or user instructions. OpenAI’s Codex repository prompt documentation describes the file’s scope as the directory tree rooted where it appears; deeper instruction files take precedence for their own subtrees. Direct system, developer, and user instructions take precedence over repository guidance.
As an Amazon Associate I earn from qualifying purchases.
That distinction matters: an instruction file may be relevant to how an agent edits a project without being trusted to redefine the task, request unrelated actions, or grant itself access. In pull-request workflows, the file may be controlled by the contributor whose changes the agent is reviewing. OpenAI’s Codex Action security guidance therefore treats PR-controlled AGENTS.md, AGENTS.override.md, and configured fallback project documentation as part of the untrusted input surface.
Where can a repository prompt injection appear?
Do not limit inspection to source code. Instructions intended to manipulate an agent can appear anywhere repository or pull-request content enters its context. OpenAI’s Codex Action guidance identifies pull-request bodies, commit messages, repository instruction files, and screenshots as possible carriers, alongside code and project documentation.
#1 Best Overall
The Codex Security threat model makes the boundary broader still: repository contents, filenames, symlinks, model output, patches, service responses, and imported artifacts are data. Their presence does not authorize the agent to change targets, expand scope, use a different credential, perform unrelated reads or writes, contact an unapproved network destination, bypass a restriction, or accept incomplete coverage. See the Codex Security policy.
How to safely run an AI coding agent on untrusted code
1. Restrict who can start an agent run
Decide which contributors and bot identities can trigger workflows that give an agent repository access. Apply the repository platform’s access controls to the workflow trigger, rather than assuming that a later human review will neutralize anything the agent encounters. OpenAI’s Codex Action guidance recommends restricting triggers and trusted bot identities.
2. Define the task and its boundaries directly
Tell the agent what to do, which files or components are in scope, and what actions are out of scope. Treat instructions found in the pull request, commit history, repository files, or imported materials as content to assess—not as authorization to redirect the task. If repository guidance is useful, the agent can follow it only within the boundaries set by its higher-priority instructions.
3. Give the agent only the permissions it needs
Limit credentials, write access, tools, and network access to what the task requires. Repository content must not be able to authorize use of another credential, a different target, an unrelated write, or an unapproved network destination. Where a task can be completed without a permission or secret, do not expose it to the workflow.
4. Review changes and consequential actions
Inspect generated patches and review consequential actions before they are accepted or executed. Approval provides oversight, but it is only one layer: the Codex Action guidance cautions that manual approval does not remove other risks from untrusted inputs. Combine review with restricted triggers, explicit scope, and limited permissions.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What these safeguards can—and cannot—do
These practices reduce the opportunities for malicious repository content to influence an agent and limit the damage if it does. They are not a proof of perfect prevention. OpenAI describes prompt injection as “an evolving security challenge” in its prompt-injection guidance, which also warns that broad delegation can make hidden malicious content more likely to mislead an agent.
The official guidance is qualitative: it does not establish a prevalence rate, a success rate, or a numeric ranking of these controls. Choose safeguards based on the workflow’s exposed inputs and potential impact, and use multiple layers rather than relying on a single approval step.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
