AI coding agents are writing a growing share of production code. Whether it’s Cursor, Copilot, or Claude Code, developers are increasingly pair-programming with models that generate, refactor, and ship real software. Naturally, this created a problem: agents don’t know your codebase conventions, your architectural decisions, or your dependency preferences. They go wild. The community’s answer was AGENTS.md, a repo-level instruction file that tells agents how to behave. It’s a pragmatic, elegant solution. Write your conventions once, and every agent session picks them up automatically. No more repeating “we use slog not log” in every prompt.

The security community has spent the last couple of years sounding the alarm on prompt injection. Rightly so. Untrusted input that manipulates an agent’s behavior is a serious threat. But AGENTS.md is prompt injection by design. It’s a file that deliberately shapes the agent’s output on every interaction. The difference is that the repo owner controls it. This is worth pausing on. If you already have a mechanism that influences every line of agent-generated code in your repository, why limit it to tabs-vs-spaces and import ordering? The same channel that nudges style can nudge security.

Developers now ubiquitously use agents to write code, and the results are notoriously riddled with security issues. One only needs to glance at the OpenClaw discourse to see the growing catalog of vulnerabilities shipped by agent-generated code. This makes the opportunity even more compelling. Consider what becomes possible when security teams start contributing to AGENTS.md. A single line like “never interpolate user input into SQL queries; always use parameterized statements” will be followed by the agent on every code generation, across every contributor, in every session. No training required. No linter to configure and maintain. No link to a wiki that nobody reads. You can go further: “always pin dependency versions to exact SHAs,” “never store secrets in environment variable defaults,” “always validate and sanitize API inputs before processing.” These aren’t aspirational guidelines sitting in a Confluence page. They’re instructions that the agent applies at the exact moment code is being written. Security teams get to push guardrails into the development loop at the point of highest leverage, before the code even exists in a PR.

The real power here is organizational. Create a company-wide AGENTS.md template that ships with every new repository, and you’ve just given every engineer in the company the same security baseline. Junior developers, contractors, new hires on day one: they all benefit because the agent enforces the rules regardless of the human’s experience level. This sidesteps the classic adoption problem where security tooling gets ignored, misconfigured, or quietly removed from CI because it’s “too noisy.” And if AGENTS.md becomes a security control, treat it like one. Add your security team to the CODEOWNERS file for it. Now any change to those guardrails requires security review before it merges. You get a governed, auditable control point in every repository, maintained through the same pull request workflow developers already use daily.

To be clear, AGENTS.md is not a replacement for proper security tooling. Static analysis, dependency scanning, secret detection, admission controllers: all of those still matter. Agents can misinterpret instructions, hallucinate exceptions to rules, or simply be overridden by a developer who knows better (or thinks they do). But as a layer in a defense-in-depth strategy, it’s surprisingly high leverage for near-zero friction. The best security controls are the ones people actually use. This one requires no behavior change at all. Developers keep prompting their agents exactly as before; they just get safer code out the other end. Sure, developers can bypass AGENTS.md entirely. But most engineers aren’t trying to be malicious; they’re trying to ship as quickly as possible. A guardrail that’s already in the path of least resistance will catch the vast majority of cases. In a world where agents write more code every quarter, shaping how they write it isn’t just convenient. It’s a security imperative.