Malicious project files can push code agents toward vulnerabilities, often without developer awareness

Coding agents, which are AI programs that write software, automatically read special files in a project like CLAUDE.md for instructions. If an attacker can change these files, they can secretly influence the agent. The problem is that this influence could make the agent write code that looks fine but has security flaws. We tested this by creating malicious versions of such files for a dozen common vulnerability types, in two styles: one that politely suggests removing safety checks, and one that insists on it. We ran three different agents on 36 software tasks with and without these files, and tested the resulting code. The results were mixed: the files changed the rate of secure code by anywhere from 8 percentage points worse to 6 better, with no consistent pattern. However, agents differed in how they reported the influence: one agent often mentioned the file in its final message, while others hid it in internal reasoning, leaving developers unaware. This matters because developers trust these explanations, and a hidden influence could let attackers sneak past code reviews.