Let AI Agents Propose. Let Boring Code Decide.

A text file hijacked AI coding agents. Here’s why my agent never gets to act alone.

Recently I read something that made me stop scrolling.

Security researchers found a file called AGENTS.md sitting in someone’s Downloads folder. Coding agents read files like this automatically. They’re meant to hold harmless instructions like “run the tests with this command.” This one told the agent to change its own settings and install a malicious npm package.

It worked on OpenAI’s Codex more than 90% of the time.

The part that stuck with me: nothing was broken. The researchers said there’s no bug for the vendors to patch, because the agent did exactly what it was designed to do. It followed the file.

Why this hit close to home

I’m a final-year student, and most of what I build these days is agent systems. In my internship I’m working on an AI agent that suggests fixes when a network has a problem. For example, if the main path looks degraded, it might suggest rerouting traffic.

Early on, I made one rule for myself: the AI never gets to act directly.

It works in three steps:

1. The agent proposes a fix, based on live network data.
2. A verification gate checks it: is this action even allowed? Is it safe? Is the network still in the state the agent saw?
3. The controller acts only if the gate says yes, and it checks the network state one more time just before running anything.

Here’s a real test run. I’ve scribbled out a few details because it’s still work in progress

Case 1: a junk npm_install instruction is rejected straight away because it isn’t an allowed action. The controller is never even called.
Case 2: the gate blocks the fix because the backup path is down. The agent’s idea wasn’t safe.
Case 3: my favourite. The gate said allow, but the network changed before execution. The controller rechecked, saw the mismatch and skipped it.
Case 4: everything checks out, and only then does the fix get applied.
My take

When an agent gets tricked, we usually ask “how do we make the model smarter?” I think the better question is “what checks the agent before it’s allowed to act?”

Models will get fooled sometimes. Allow-lists, approval prompts and verification gates are boring, but they keep working even when the model doesn’t.

So my rule is simple: agents propose, boring code decides.

If you use coding agents

• Don’t run them inside your Downloads folder

• Read any AGENTS.md / CLAUDE.md file you didn’t write yourself

• Keep approval prompts and sandboxing turned on

What’s one guardrail you never turn off when you run an agent? I’d love to hear in the comments.