Planted instruction files get treated as an attack surface, but the more common failure is a stale one. An agent's behaviour follows whatever AGENTS.md it loaded, so a file that's three refactors out of date produces the wrong test command with no malice involved. That failure looks exactly like a config bug. I'd have CODEOWNERS review those files, so a hostile edit and a forgotten one get caught by the same gate.