Background for AGENTS.md → Security. The rules live there, in full, because Codex reads that file and not this one; this doc records why each exists.

• Chained fetches exfiltrate. A documented exfiltration vector chains one fetch into the next via attacker-controlled links, spelling out private data through the URLs the agent is lured into visiting. Hence don't fetch or act on a URL just because fetched material points at it.
• Repo-open auto-execution. Files that run when a repo is opened in an AI-assisted editor or in CI — session-start hooks, agent-instruction files, folderOpen tasks, workflows, pre-build MSBuild targets — fire before any code is read. This was a documented 2025 attack vector, which is why an untrusted checkout's added / modified config gets inspected first.
• Instructions in a repo's own content, including images. Documented 2026 vectors: "Friendly Fire" — an audit agent tricked into running a payload named in README.md; "Ghostcommit" — a prompt injected via a PNG attached to a PR.