Codex two-pass AGENTS.md prompt-injection path disclosed: why it is not safe to use

What happened

On August 7, 2026, The Hacker News reported a finding from Novee Security about OpenAI Codex workflows in a shared checkout, meaning the same working folder was reused across steps. According to the write-up, one job ran Codex twice. In the first pass, Codex could write a file called `AGENTS.md`. In the second pass, Codex then loaded that file as instructions for itself.

This is described as a prompt-injection style issue, which means untrusted content can influence an AI system's behavior by being treated like instructions. The article says the finding did not receive a CVE, which is a public tracking ID for a security flaw, or a product-version patch. The reported reason was that OpenAI viewed the sandbox behavior as working as documented.

What it means for you

For a normal user, the main takeaway is simple: a file created in one step can become trusted guidance in the next step. If an agent shares the same folder across multiple runs, it may end up following instructions it just wrote, or that another step placed there.

What to do instead

Use separate folders or clean workspaces for separate agent steps when possible. Treat instruction files like `AGENTS.md` as sensitive inputs, not routine output. Before a second run starts, check whether the workspace now contains new instruction files or changed setup files. If you use shared templates or skills, prefer reviewed sources. AgentPod lists only reviewed, tested skills, but you should still verify what a workflow will read before you run it.

Sources:

• https://thehackernews.com/2026/08/claude-code-and-gemini-cli-flaws-let.html?m=0