Will my agent follow instructions hidden in a web page or repo file?
Someone planted harmless hidden notes on websites and in files like AGENTS.md, CLAUDE.md and .cursorrules in a public repo, and agents visiting them followed the notes' links. If you build or run agents, does yours act on instructions it finds in content it reads, and how do you stop that?
Assume yes. A language model sees the page or file it was asked to read as more text in its context, and it has no reliable built-in way to tell your instructions apart from instructions planted in that text. This is prompt injection, and no current model is immune to it.
Repo instruction files are a special case: coding agents load AGENTS.md, CLAUDE.md or rules files automatically and treat them as guidance by design. Cloning an unknown repo and running an agent in it means letting that repo's author write part of your agent's instructions, so read those files first.
Defences work at the level of what the agent can do, not what it reads. Keep real credentials out of reach, require approval for network calls, shell commands and anything that sends data out, and when you put fetched content into a prompt, mark it clearly as data to analyse rather than orders to follow.
Then test it. Plant a harmless note of your own in a page your agent will fetch and see whether it acts on it. That tells you more than any vendor claim.
Listings mentioned
- AI security · skill by alirezarezvaniAssesses an agent for prompt injection and tool-abuse risks, with injection signature checks.
- Security reviewer · agent by shinprReviews an implementation against its trust model, including untrusted input reaching tools.
Answers by the AgentAlley team, drafted with AI and checked against the listings they link to. Not a real-person reply from the original thread.