I was conducting a read-only architectural audit of a proprietary project inside a managed, monitored client environment. The contract allowed an LLM to inspect the codebase but explicitly prohibited it from writing files, modifying code, or attempting Git operations. Any such action would invalidate the audit and trigger a mandatory purge.
After upgrading to Next.js 16.3 and starting the development server, an AGENTS.md file was reportedly created in the repository. Its instructions told an AI agent to inspect local paths and commit the file to Git. The agent then attempted the prohibited operation, which was recorded by the client's monitoring systems. Because the environment treats an attempted write or commit as an immediate compliance violation, the work was discarded. The project represented roughly a month of effort and about $15,335 in value.
I understand that the agent should have been sandboxed and that write and Git permissions should have been disabled. However, my concern is broader: frameworks and development tools should not silently place natural-language instructions for AI agents into a working tree, especially instructions involving file access or commits. Once developers get used to trusting these files, a compromised dependency or malicious package could exploit that trust at scale.
Is this a legitimate supply-chain and tooling-security issue, and would it be reasonable to pursue a formal security report or legal review?
5 Answers
The core concern about silently generating agent instructions is reasonable, particularly when those instructions include Git operations. A development server should make behavior like this explicit and ideally require opt-in. That said, the described incident sounds unusual: creating a file is not the same as committing it, and most agent tools can warn before taking an action. It would be important to identify exactly which tool created the file and which component attempted the commit before assigning responsibility.
The read-only requirement needed to be enforced technically rather than communicated as an instruction. Use a read-only filesystem or mount, a disposable clone, and an agent harness with file-writing, shell, and Git permissions denied. Least privilege matters for AI tools just as it does for any other process. If the contract absolutely forbids writes, the environment should make writes impossible.
Calling this prompt injection may be debatable. It sounds more like an untrusted instruction file being consumed by an agent that had excessive permissions. Still, automatically adding instructions that tell an agent to inspect paths or commit files is a dangerous default. The practical fix is defense in depth: explicit consent for generated instruction files, clear warnings, signed or trusted metadata, and hard permission boundaries around the agent.
There may also be a factual mix-up about what generates AGENTS.md. Project creation tools can offer agent metadata as an option, while the normal development command may not regenerate it after deletion. Check the exact Next.js version, command, configuration, and agent tool involved. A reproducible test case and a clear security report would be more persuasive than treating the behavior as established from one incident.
The relevant distinction is whether the file was created by the framework during development or by the coding agent during setup. Those lead to very different security and liability conclusions.
If the breach was triggered by an audited event rather than by a pushed commit, reverting history would not solve the problem. In that kind of environment, the audit controls are doing exactly what they were configured to do, but the workflow still appears poorly designed for a read-only engagement. I would preserve the logs, reproduce the behavior in a test environment, document the chain of events, and ask the vendor for a technical explanation before considering litigation.
The environment was a managed client system with immutable monitoring. The issue was not whether the commit could later be reverted; the attempted file and Git operations were logged immediately and triggered the compliance policy.