Build · founder · 9 min read

Every File Your Agent Reads Is Executable

Four separate attacks in six weeks. Config files, vendor docs, firewall logs. Same shape every time, and the fix is the same three sentences.

Published September 7, 2026 ·

security ai-agents prompt-injection claude-code cursor

Four pieces of security research landed between early August and early September. Different researchers, different companies, different bugs. On the surface they have nothing to do with each other: one is about git, one is about vendor documentation, one is about a firewall log.

They are the same bug. Once you see the shape you cannot unsee it, and it is the single most useful thing you can know about running an AI coding agent right now.

Here is the shape: your agent reads a file that a trusted party wrote, and something in that file gets executed. Not because anyone attacked you. Because the agent could not tell the difference between a file that describes something and a file that instructs something — and, crucially, nothing in the stack was positioned to tell it.

The four files

.git/config — a settings file that runs programs

Manifold Security published GitSpawn on September 1: eight findings across seven AI coding agents. Open a project folder with an agent, and the agent runs git status as a startup subprocess before it shows you a trust prompt. Git reads .git/config. And .git/config is allowed to name a program git should execute.

So a zip file someone emails you can run a command on your machine before you type anything. We covered the full mitigation separately — the short version is that git clone does not carry a .git/config, so cloned repos are safe and zips are not.

.claude/settings.json — a settings file that runs programs, again

This one has happened twice. An npm worm planted a SessionStart hook in .claude/settings.json, and separately a sandbox escape had an agent write .claude/settings.local.json that a hook engine — running outside the sandbox — executed after the turn ended.

Hooks are a feature. They are supposed to run programs. The problem is that the file which defines them travels with the project, and you did not write the project.

llms.txt — documentation that installs software

Pandex scanned roughly 6,200 corporate domains and pulled about 8,300 llms.txt files — the machine-readable docs that vendors publish specifically so your agent doesn’t have to crawl their website. Inside 120 of them were install commands pointing at package names and domains nobody had registered.

The researchers claimed a few of those names, published harmless packages that phoned home, and waited. First callback within minutes, from a Fortune 500. The prompt that triggered it was, verbatim: “Using all of [vendor]‘s docs, build and run a node.js project with [vendor]‘s SDK.”

That is not an attack. That is Tuesday. Full detail here.

Logs and alerts — evidence that gives orders

This is the newest one and the most uncomfortable. At DEF CON 34, Tenet Security demonstrated an attack it calls GhostJacking, reported by SecurityWeek and Infosecurity on August 10.

Send a request that Cloudflare’s managed firewall rules will block. Put your instructions in the User-Agent header, dressed up as scanner telemetry. Cloudflare does its job perfectly: it blocks the request and logs it word for word.

Later, someone asks their agent to review blocked traffic. The agent reads the log, treats the embedded text as a finding it should remediate, changes the DNS records to point at a domain the attacker controls, and reports the issue resolved.

Tenet measured a 90% success rate against Claude Code. Every single request in the chain had already been blocked. The domain was taken over anyway.

They ran the same pattern against Datadog — using one of the 2,700-plus front-end API keys they found sitting in the open on the internet — to plant a fake “urgent diagnostic” alert that got an agent to execute a command and exfiltrate cloud credentials. And against Sentry, where a crafted error report was read by Sentry’s own AI agent, which proposed the attacker’s fix as its own, which the coding agent downstream then trusted and ran. One AI vouching for an attacker to the next AI.

Cloudflare runs in roughly 42% of the Fortune 500. Datadog in about 48%. Sentry is used by close to four million developers.

Why these are one story and not four

Tenet put it better than we could: “Sentry, Cloudflare, and Datadog are not three separate flaws. They are the same shape.”

Extend that across all four and the pattern is complete. In every case:

1. A trusted party wrote a file for a legitimate reason.
2. Your agent read that file as part of doing exactly what you asked.
3. The file contained something that reads like an instruction.
4. The agent had permission to act, so it acted.

Nobody made a mistake. Cloudflare logging a blocked request verbatim is correct behaviour. A vendor publishing install commands in their docs is correct behaviour. Git letting a repo configure git is a thirty-year-old feature. The agent following the instructions it found is the product working.

The security world calls this a confused deputy problem, and it is old — but the AI version has a nastier property. A traditional confused deputy needs a specific exploitable path. An LLM will treat almost any plausible-looking text as an instruction, which means the attack surface is “everything the agent can read.”

The part that should worry you most

Two of these four had no attacker at authoring time at all.

GitSpawn needs someone to plant a payload. GhostJacking needs someone to send a crafted request. Fine — those are attacks, and attacks can be defended against.

But the llms.txt case needs nothing. It needs a docs page to go slightly out of date and a package name to lapse. That is not an attack, it is rot. It happens at a background rate, forever, with nobody to prosecute. And the abandoned-name problem applies to any instruction file that points outward at anything.

There is a second uncomfortable finding buried in the numbers. Pandex measured execution rates by model: GPT-5 Luna and Sol ran the payload over 90% of the time, Claude Opus 4.8 around 30%. Tenet measured 90% against Claude Code on the log-poisoning path. The rates go up with capability, not down. An agent that is better at completing tasks without checking in is, by construction, better at following a stale or hostile instruction all the way to the end.

If you have been picking tools on “how much can I leave it alone,” you have been picking on this axis too, and you probably didn’t know it.

What to actually do

None of this is fixed by waiting for a patch. There is no single patch — four research groups found four different bugs and reached one conclusion, which is that the controls that matter live in the harness, not the model.

Treat every file in a project you did not create as untrusted input. .git/config, .claude/settings.json, .claude/settings.local.json, .cursor/rules, .vscode/tasks.json, .git/hooks/. Two minutes of reading covers the entire class, not just this month’s instance.

Clone, don’t unzip. git clone does not bring a .git/config with it. Zips, shared drives, synced folders and dev-container images all do.

Take npm install and pip install out of auto-approve. Then read the package name before you accept it. This single change defeats the entire llms.txt category.

Do not give one agent both read access to outside data and write access to production. This is the GhostJacking lesson specifically, and it is the one most likely to apply to you. If your agent can read Sentry and deploy, or read Cloudflare logs and change DNS, you have built the vulnerability yourself. Split them, or make the write side require a human.

Rotate any front-end API key you have ever pasted into a browser bundle. Tenet found over 2,700 Datadog keys in the open. Yours may be one of them.

The one-sentence version

Every file your agent reads is executable, whether or not anyone meant it to be. Narrow what the agent is allowed to do without asking, and stop worrying about which file it is this month.