---
title: "Comment by Adam Lewis on \"Prompt injection in AI coding agents: how one CLAUDE.md or AGENTS.md can hijack them\" | Hashnode"
description: "Planted instruction files get treated as an attack surface, but the more common failure is a stale one. An agent's behaviour follows whatever AGENTS.md it loade"
url: "https://hashnode.com/posts/ai-coding-agent-prompt-injection-claude-md-agents-md/6ae0f55d40406a1a227f9be4/comment/6aee4b63e2824a7aaea278ff"
---

[Discussion](https://hashnode.com/posts/ai-coding-agent-prompt-injection-claude-md-agents-md/6ae0f55d40406a1a227f9be4)

Comment [Prompt injection in AI coding agents: how one CLAUDE.md or AGENTS.md can hijack them](https://hashnode.com/posts/ai-coding-agent-prompt-injection-claude-md-agents-md/6ae0f55d40406a1a227f9be4)

[Adam Lewis](https://hashnode.com/@nark3d)

[6d ago](https://hashnode.com/posts/ai-coding-agent-prompt-injection-claude-md-agents-md/6ae0f55d40406a1a227f9be4/comment/6aee4b63e2824a7aaea278ff)

Planted instruction files get treated as an attack surface, but the more common failure is a stale one. An agent's behaviour follows whatever AGENTS.md it loaded, so a file that's three refactors out of date produces the wrong test command with no malice involved. That failure looks exactly like a config bug. I'd have CODEOWNERS review those files, so a hostile edit and a forgotten one get caught by the same gate.