Skip to content
redactsure
Book a demo

Explore.

Data Report · By Chris Sowa · Published
Last updated

Can a README Hijack My Coding Agent?

Yes: a README inside a dependency is text written by a stranger that the agent reads as documentation, and a line in it can work as an instruction. The sources reviewed document mitigations and limits and not immunity, so check what your agent holds that would be worth hijacking.

A credential reference travels from a browser record through a bounded route to a separate API destination.

A coding agent that installs a package also takes in its README, its changelog and a folder of text files, all written by someone the team never reviewed, and an agent asked to understand the library will read them. The question in the title is whether one of those texts can steer the agent, and the answer on the record is that any text an agent reads can carry an instruction it may treat as part of the task. This page follows that path for one channel, a README inside a dependency folder. The record on that path is consistent: published mitigations limit how far an injected instruction travels or add friction, and the vendors that document their controls state those limits themselves. It ends with a test a team can run on its own agent, and with the control class that decides what a hijack is worth: an agent that holds nothing worth taking gives a README little to steal. Two sibling pages take the neighbouring cases, How Does Prompt Injection Get Into a Coding Agent? and Can a GitHub Issue Hijack My Coding Agent?.

Key findings

  • A study of prompt injection attacks on agentic AI coding editors reports that "attack success rates can reach as high as 84% for executing malicious commands," though the abstract gives no trial counts, tool versions or channels (Liu et al., 2026).
  • SLSA's threat list includes an attacker who "added an innocuous dependency and then later updated the dependency to add malicious behavior," which is how a package reviewed once can carry new text, a README included, after the review (SLSA, 2026).
  • Anthropic's Claude Code documentation states that "While these protections significantly reduce risk, no system is completely immune to all attacks," a vendor describing mitigation and not immunity (Anthropic, Security, 2026).
  • OWASP's Top 10 for Agentic Applications lists ASI01 Agent Goal Hijack, ASI02 Tool Misuse and ASI04 Agentic Supply Chain Vulnerabilities among its ten risks, and states that "Once AI began taking actions, the nature of security changed forever" (OWASP GenAI Security Project, 2025).
  • A governed environment replaces values with consistent tokens such as TOKEN_001 before any model reads the screen, so an instruction that reaches the model finds placeholders where the credentials were (What Is the Lethal Trifecta for AI Agents?).
  • Real values resolve only at the approved destination at the moment of an approved action, which breaks the path from private data to external communication that the lethal trifecta describes (What Is the Lethal Trifecta for AI Agents?).

What does a governed browser environment cover when a README reaches a coding agent?

A governed browser environment covers what an agent reads and does on a rendered page: dashboards, consoles, settings pages and a repository's web pages. It does not cover the terminal, the IDE, the local filesystem, direct API calls or MCP. That boundary decides how much of this page a browser control reaches. A README opened on a repository's web page is inside the scope. A README read from a dependency folder on disk is on the local filesystem and outside it, so the first step is to find out which of the two the agent used.

The example record is a README in node_modules. A package manager places a dependency's files in that folder, and the README among them is documentation written by the package's author, or by whoever last changed the package. A line in it addressed to the agent, placed under a heading that looks like setup notes, reaches the model as text in its context, next to the task it was given. A person skimming the file sees installation notes. The agent receives every line, including one written for it.

The sources reviewed do not report an incident in which a README in a dependency folder hijacked a named agent. What they document is the route and the limits of the controls around it, which is what the rest of this page reads. Treat the question as open for any particular agent until a test on that agent answers it.

How does a README in node_modules reach the agent?

Through the dependency itself, and the dependency may be one nobody chose. Code generating models hallucinate package names at a rate of "at least 5.2% for commercial models and 21.7% for open-source models," so a dependency can be one the developer never chose (Spracklen et al., 2025); the abstract does not say whether hallucinated names were registered and exploited. OpenAI's Codex cloud documentation, marked Legacy, notes that "Setup scripts still run with internet access so you can install dependencies," which is the point where a dependency's files arrive on the machine, and the page describes no check of what those files say (OpenAI, 2026).

The attack class has a name. The channel is indirect prompt injection, named in a paper titled "Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection" (Greshake et al., 2023). Greshake and colleagues named the attack and showed that LLM-integrated applications could be compromised through content they retrieved rather than through the user's prompt, as the linked page reports (What Is Indirect Prompt Injection and How Does It Reach AI Agents?). The README is one more place where retrieved content and the task share a context.

A dependency can also change after it was reviewed. SLSA also lists a compromised build platform whose attacker "installed an implant that injected malicious behavior during each build," which changes a package without any change to its visible source (SLSA, 2026). The same list names an attacker who "added an innocuous dependency and then later updated the dependency to add malicious behavior," so a README that was clean at review time is not a guarantee about the next release.

What do the vendors themselves say?

The vendor pages below describe mitigations, and each states what it leaves open. Read the second column for what the vendor documents and the third for the question it leaves with a buyer.

Dimension Vendor, per its documentation What a buyer should verify
Reading files Anthropic's permissions documentation states that "To block Claude's file tools from reading a file or directory, add a Read deny rule for its path," that a .claudeignore file "has no effect," and that deny rules "don't apply to a command that reads files without naming them" (Anthropic, Configure, 2026). Whether the agent reads dependency folders through file tools, which the rules cover, or through shell commands, which they may not.
Approved commands Anthropic's Claude Code documentation states that "The boundary is a permission prompt, so a Bash command you approve can still write anywhere your user account can" (Anthropic, Security, 2026). What an approved command may touch, and whether the person approving sees the text that prompted it.
Internet access OpenAI's Codex cloud documentation states that "By default, Codex blocks internet access during the agent phase" and advises to "allow only the domains and HTTP methods you need, and review the agent output and work log," though the page is marked Legacy and does not explain how allowlists are enforced (OpenAI, 2026). Whether the product in use is the one documented, since the page is marked Legacy. The same OpenAI page lists prompt injection from untrusted web content as a risk of enabling internet access, and it is marked Legacy, so a reader should check the current product page (OpenAI, 2026).

Anthropic and OpenAI both document where their controls stop, and neither page claims that reading is made safe. Anthropic states that "no system is completely immune to all attacks," and OpenAI advises reviewing the agent's output and work log. That is the information a buyer needs, because the README is read before any of those controls has anything to approve.

What can an instruction in a README make the agent do?

It can try anything the agent can do, and what it costs depends on what the agent holds. Simon Willison defined the trifecta as "Access to your private data," "Exposure to untrusted content," and "The ability to externally communicate," and notes that even a request "to load an image" can carry stolen data (Simon Willison, 2025). A coding agent with a shell, a browser and repository access can have all three legs: the private data is the repository and its environment, the untrusted content is the README, and the ability to communicate externally is a git push, a fetched URL or a form submitted on a page.

The documented limits show how far that reaches. Anthropic's Claude Code documentation describes bash sandboxing with "filesystem and network isolation, reducing permission prompts while maintaining security," which limits what a command can touch and does not stop the agent from reading an instruction (Anthropic, Security, 2026). Anthropic's documentation adds that deny rules "don't apply to a command that reads files without naming them," so a rule that protects a named file does not protect a search across the folder.

Research on coding editors puts a number on the risk without settling it for any one product. Liu and colleagues report success rates as high as 84 percent for executing malicious commands, and their abstract gives no trial counts or tool versions. Read it as evidence that the class is real and not as a rate for any tool. The sibling page on issues (Can a GitHub Issue Hijack My Coding Agent?) takes the case where the text arrives through a ticket, and the page on how injection gets in (How Does Prompt Injection Get Into a Coding Agent?) lists the other channels.

How can a team test whether a README can steer its agent?

Plant one instruction in a test dependency's README, on a test repository with a test token. The line asks the agent to print an environment value or fetch a URL. Install the package in a scratch project, ask about the library, and record whether the agent read the file, whether it acted on the line, and what it held when it did.

Then repeat the run with one control changed at a time: a deny rule for the folder, then a recursive search against it; network access blocked; the token moved out of the agent's environment. The point is to learn which layer stopped the attempt, because a layer that limits reach and a layer that removes the value fail in different ways. Cloud setup tasks raise the stakes: AWS states that it strongly recommends not creating access keys for the root user, which rules out the simplest way to give an agent durable top level power, as the linked page reports (Is It Safe to Let an AI Agent Set Up Your Cloud Environment?).

Keep the result beside the date and the agent version, and repeat it when the agent gains a tool. Research on web forms points the same way. An environmental injection attack on generalist web agents reached an attack success rate of up to 70 percent in stealing users' specific personal information, as the linked page reports (Can an AI Agent Sign Up for Developer Services Without Seeing Your Payment Card or Identity?). The data an instruction asks for is the data the agent was shown. Simple prompt injections asking agents to leak personal data they observed during task execution reached average attack success rates around 20 percent in a University of Zurich study, as the linked page reports (Does Prompt Injection Expose Customer Records?).

What does a governed environment change?

A governed environment is a control class that acts where a screen is rendered, before any model reads it. Values chosen by policy are replaced with consistent tokens for the whole run, so the model works on placeholders such as TOKEN_001. Real values resolve only at an approved destination, at the moment of an approved action. A named person confirms the tokenization policy and approves each consequential action, including every payment, submission and record change. Every screen as tokens, every action and every approval is written to a record that exports to the organization's own monitoring.

For this page's question, it does not stop a README from being read, because the README is text and the model reads it. It changes what the instruction can get. A README that asks for the token finds TOKEN_001, and a send of that placeholder resolves nowhere. The reach of a hijack shrinks to the placeholders the model held, and a design pattern the record describes points the same way: Willison's design patterns "constrain the actions of agents to explicitly prevent them from solving arbitrary tasks," and one pattern lets agents "trigger tools, but cannot be exposed to or act on the responses from those tools" (Willison, Design, 2025). (Will Prompt Injection Ever Be Fixed at the Model Level?). The approver sees the destination and the placeholder and not the credential.

It governs the rendered page and nothing else. A README read from a dependency folder, a command run in a shell and a fetch made from the terminal are outside it, and stay with the sandbox, the permission rules and the credential store the team configures for that agent.

Methodology and limitations

This page rests on three research preprints on prompt injection in coding editors, package hallucination and the founding paper on indirect injection cited by its title, vendor documentation from Anthropic and OpenAI, a supply chain threat specification from SLSA, OWASP guidance for agentic applications, practitioner analysis from Willison, and existing RedactSure research pages. Vendor pages were read as of October 20, 2026, and each Sources line carries the date for its page. Quoted facts are cited to the page that states them, and figures from research are cited as reported and not as independently measured. The preprints are cited for what their abstract pages state and not for details those pages do not give.

RedactSure did not test any of the named products hands-on. "Not described" means not described in the pages reviewed. The route from a README to an agent is a classification of how dependency files are read, and the sources reviewed do not report an incident for it. The Greshake paper is cited for what its title states. Statements about RedactSure describe its current design, and RedactSure is deploying now with enterprise and government customers. The example describes a record type, a README in node_modules, and not an organization. Vendor features change, and the page carries its date; a reader should treat a release after that date as unreviewed until the test above is repeated.

Determinations about whether a prompt injection control meets a contractual, regulatory or audit requirement belong to counsel, assessors and the organization's own security and compliance officers. Nothing here replaces a test of the organization's own agent against a test repository, repeated after each release.

What the record shows

A README in a dependency is text the agent reads, and the record on mitigations is consistent: they limit reach or add friction, and the vendors that document them say so. The package can change after review, and the figures on injection success are evidence of a class and not a rate for any product. The values the agent holds decide what a hijack costs; RedactSure's environment removes them before the model reads the page. To measure that cost on a real deployment, name one agent and one task, plant an instruction in a test dependency's README, and write down what the model held and what it tried to do.

Frequently asked questions

Can a README hijack my coding agent?

It can try. A README is text the agent reads to understand a library, and a line in it addressed to the agent sits in the same context as the task. Whether a given tool acts on the line depends on the tool, its permissions and what it holds, which is why the sources reviewed give a class of risk and no per product verdict. Plant one instruction in a test dependency and watch what your agent does. Treat any answer as provisional until your own run shows it.

Why is a README in node_modules a risk and not just documentation?

Because the author of the file is not the team. A package manager places the dependency's files on the machine, and the README is written by the package's author or by whoever last changed the package. SLSA lists an attacker who updates a dependency after it was reviewed. Nothing about the file's location makes its contents trusted, so the review has to cover the version actually installed. Pin versions, read the README again when the version changes, and check the file the agent actually opened. Do this for each release.

Do deny rules protect a dependency folder?

Partly. Anthropic documents that a Read deny rule blocks the file tools from reading a path, and that the rules do not apply to a command that reads files without naming them, such as a search from the folder above. A rule is a layer for the paths it names. Test a recursive search against the folder before relying on the rule, and keep the credentials out of reach as well. Run the test once with the rule on and once with it off.

Is blocking internet access enough to stop a README attack?

No, because the README is already on the machine. OpenAI's documentation, marked Legacy, blocks internet access by default during the agent phase, and the setup step still runs with access so dependencies can be installed. Blocking the network limits where an instruction can send data, which is a separate benefit. It does not remove the instruction from the agent's context. Pair it with a limit on what the agent holds, since the instruction can still ask for whatever is in reach.

What is the lethal trifecta and does a README supply it?

The trifecta is private data, untrusted content and the ability to communicate externally in one agent. A README supplies the untrusted content, and a coding agent often already has the other two through its repository, its environment and its shell. Removing any one leg shrinks the risk, and each leg can be tested on its own. Untrusted text is hard to avoid, so teams usually act on what the agent holds and where it can send things.

What should a team ask a vendor in writing?

Which files the agent reads without a person reviewing them; what the model holds while those files are in its context; which controls limit the reach of an injection and which claim to prevent it; what happens to a command the injected line asks for; and what record shows the input and the action. Treat any answer the documentation does not support as unanswered until a test confirms it.

About the author

Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.

How RedactSure Leaves a Hijacked Agent Nothing Real to Send

Permission rules, sandboxes and network blocks limit what an instruction can do, but they leave it in the model's context next to the real values the agent saw.

The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.

Before: the agent reads a README from a dependency on the repository's web page while holding the real token the console showed, so a line in the file can ask for it. Inside the governed environment: the model reads TOKEN_001, a named person approves any submission, and the line finds a placeholder to send.

RedactSure is deploying now with enterprise and government customers. Claude Code's documentation states that no system is completely immune to all attacks.

Everyone else controls where data can go. RedactSure controls what the AI can see.

See it on your own workflow

A README instruction can only send what the model holds. Bring a repository task your agent already runs and see, with test values, what the model holds when it reads that file on the repository page. Book a demo

Book a demo

Book a demo

Having trouble? Open the booking page or email us.