Really useful write-up, and "following an instruction and granting a privilege are the same act" is the line I'll be repeating to people.
Two small additions to defences 2 and 3 that tend to catch what a one-time read misses:
Your find one-liner skips node_modules, which is right for noise, but instruction files also arrive through git submodules, vendored folders and monorepo packages pulled in later. Running the same check in CI on every PR, and failing when a new CLAUDE.md / AGENTS.md / .cursor/rules file appears or an existing one gains an install command, a URL or a config path, turns it from a habit into a gate.
Codex also reads AGENTS.override.md before AGENTS.md in each directory, so it's worth adding that name to both the find and the CODEOWNERS list. It's an easy one to miss, because nobody on the team expects that file to exist.
Do you know if the researchers tried a planted file nested deeper in a trusted repo, rather than in Downloads? That seems like the case most teams aren't watching.
Really useful write-up, and "following an instruction and granting a privilege are the same act" is the line I'll be repeating to people.
Two small additions to defences 2 and 3 that tend to catch what a one-time read misses:
Do you know if the researchers tried a planted file nested deeper in a trusted repo, rather than in Downloads? That seems like the case most teams aren't watching.