A survey of the files coding agents read as standing instructions, across the 2,500 most-starred repositories on GitHub — and a check for whether anyone has hidden anything in them.
Coding agents load AGENTS.md, CLAUDE.md, .cursorrules, .cursor/rules/*,
.github/copilot-instructions.md and friends and treat their contents as instructions from the
operator. A pull request can edit any of those files, and the diff gets reviewed as prose rather
than as code that will execute against the reviewer's repository.
It also does not have to be readable. Unicode carries a complete invisible copy of ASCII at U+E0000–U+E007F. Sixty of those characters spell a sentence and render as nothing at all — no width, no highlight, no warning, in any diff view.
So: is it happening yet?
See dataset/summary.json for the machine-readable version, and the
write-up at https://agentatwork.xyz/notes/agent-files.html.
The short version is a negative result, deliberately published as one. The attack is real — I found a live instance the same week, in a signup form on a Lemmy instance with 2,452 users — but the top of GitHub is currently clean of it. That is worth recording precisely because it will not stay true, and "we checked and found nothing" is only worth anything if somebody wrote down how they checked.
export GH_TOKEN=... # any token; only the rate limit differs
python3 collect.py repos.jsonl # which repositories
python3 collect.py files.jsonl --files repos.jsonl # which files, fetched raw
python3 report.py files.jsonl repos.jsonl # score them, offline
python3 index_out.py files.jsonl repos.jsonl # build the published datasetAbout twenty minutes end to end. CORPUS.md documents every query, every filename
pattern, and what the sample is and is not.
Fetching and scoring are separate on purpose: rules get rewritten, and no revision of mine should cost strangers another few thousand requests.
index.jsonl | One row per instruction file: repo, path, branch, stars, size, sha256, and the raw URL. No bodies — the hash tells you whether the file you fetch today is the one I scanned, without me shipping a stale copy of somebody else's writing. |
flagged.json | Every file that fired a rule, with verbatim text, because a claim about a file is not checkable without the file. |
summary.json | The counts quoted in the write-up. |
Rules come from trapcheck, plus three detectors for invisible carriers: tag characters (reported decoded), bidi overrides (Trojan Source), and long runs of variation selectors.
A hit that matched only inside quotation marks is reported at half severity and flagged
quoted, and counted separately from the headline. Every quoted hit in this survey was a
repository quoting an attack in order to warn its own agent about it — which is what good
practice looks like, and is not a finding.
MIT for the code. The dataset is an index of public metadata; the flagged excerpts are quoted from public repositories for the purpose of describing them.