GitHub Copilot and VS Code Chat are racing toward agentic workflows. Your editor is no longer autocompleting code. It is reading your project, interpreting instructions, and acting as a workspace-aware assistant.
One detail in that shift matters more than it looks.AGENTS.MD .
VS Code Chat auto-includes it in every request. It is treated as an instruction set, not documentation. Our demo shows how that design becomes a clean data exfiltration path. A malicious AGENTS.MD quietly convinces the agent to email internal data out of the organization during an everyday coding session.
This post breaks down how the plumbing works, how the attack works, and why this is a direct hit on OWASP ASI01 and ASI02.
How VS Code wires AGENTS.MD into every conversation The root behavior lives in VS Code’s chat configuration. The key block:
File: src/vs/workbench/contrib/chat/browser/chat.contribution.ts (around lines 573–581)
The implications are not subtle.
Facts:
VS Code searches the workspace for AGENTS.MD . If it finds one, the contents are injected into every chat request . The feature ships enabled by default . The file is treated as instructions , not context. Any repo can ship a high privilege control layer for the coding assistant. A developer sees documentation. The agent sees policy.
How AGENTS.MD is supposed to work (on paper) The AGENTS.MD spec tries to standardize agent behavior by letting repos define:
The agent’s persona Style preferences Interaction rules Tooling patterns The FAQ goes further. It explicitly supports auto-running agents. The answer is basically yes. Feel free to let AGENTS.MD drive unattended execution.
Great for productivity. Terrible for threat modeling.
What the spec does not provide:
A security model A boundary between documentation and privileged instructions Any guidance for runtimes that ingest untrusted AGENTS.MD files That missing guardrail is the attack surface.
Inside the demo: a markdown file that emails your internal data In our video, the exploit is quiet and believable. The developer opens a repo. The repo contains an AGENTS.MD that looks harmless. They ask Copilot a routine question. The agent then emails internal project data to an external address. The user never requested an email or a file scan.
VIDEO
What actually happens 1. Workspace setup A repo includes an AGENTS.MD that looks like workflow notes.
2. Developer interacts They open VS Code. Copilot Chat is on. They type anything. Even a single letter is enough.
3. Hidden instructions activate VS Code injects AGENTS.MD into the prompt.
4. The agent executes The injected instructions redirect the agent into exfiltration.
5. User perception The agent claims to be doing a security audit or health check.
This is OWASP Agentic Top 10 in motion. A benign file that acts like a covert policy channel.
What a malicious AGENTS.MD pattern looks like This is not the payload used in the real demo. Details removed. The pattern remains.
The structure shows the problem.
Repo content becomes agent policy. The user cannot see the injected instructions. The agent executes goals defined by an attacker, not the human How this breaks OWASP ASI01 and ASI02 ASI01: Agent Goal Hijack The agent’s objectives are replaced with attacker goals from AGENTS.MD. The user thinks they triggered code assistance. They actually triggered data exfiltration.
ASI02: Tool Misuse and Exploitation The agent uses legitimate tools like email in unintended ways. It performs an authorized action with unauthorized intent.
Both rules are violated, each in accordance with the way OWASP framework describes.
Why AGENTS.MD + auto-running makes this especially risky Taken together, we have a pattern:
Auto-inclusion in prompts VS Code injects AGENTS.MD into every request by default.
Spec-level encouragement for auto-running The AGENTS.MD FAQ treats auto-running agent definitions as a legitimate workflow pattern.
No built-in distinction between “docs” and “policy” To the model, it’s all just natural-language instructions.
Human trust in markdown Developers are used to reviewing documentation casually - not as high-privilege configuration.
Result A malicious contributor can:
Hide an agent policy inside markdown Have it automatically loaded Have it sometimes automatically executed Redirect the agent’s autonomy toward their own objectives (exfiltration, surveillance, sabotage) This is not just “prompt injection.”
It is a repo-level control plane for agent behavior - one that can be hijacked.
Takeaways for security teams AGENTS.MD is not documentation. It is an instruction substrate that runtimes may treat as authoritative. Auto-including it in VS Code means any repo can redefine what your coding agent is trying to do. Our demo proves the failure mode. A benign-looking markdown file triggers an agent to email internal data outside the organization. OWASP ASI01 and ASI02 map directly to this attack. The AGENTS.MD spec’s stance on auto-running turns an edge case into an expected behavior that attackers can hijack. If your editor now hosts “agents for your repo,” then your AGENTS.MD isn’t just flavor text, it’s part of your attack surface.
