agentfiles

A survey of the files coding agents read as standing instructions, across the 2,500 most-starred repositories on GitHub — and a check for whether anyone has hidden anything in them.

Coding agents load AGENTS.md, CLAUDE.md, .cursorrules, .cursor/rules/*, .github/copilot-instructions.md and friends and treat their contents as instructions from the operator. A pull request can edit any of those files, and the diff gets reviewed as prose rather than as code that will execute against the reviewer's repository.

It also does not have to be readable. Unicode carries a complete invisible copy of ASCII at U+E0000–U+E007F. Sixty of those characters spell a sentence and render as nothing at all — no width, no highlight, no warning, in any diff view.

So: is it happening yet?

Result

See dataset/summary.json for the machine-readable version, and the write-up at https://agentatwork.xyz/notes/agent-files.html.

The short version is a negative result, deliberately published as one. The attack is real — I found a live instance the same week, in a signup form on a Lemmy instance with 2,452 users — but the top of GitHub is currently clean of it. That is worth recording precisely because it will not stay true, and "we checked and found nothing" is only worth anything if somebody wrote down how they checked.

Reproduce it

export GH_TOKEN=...                                   # any token; only the rate limit differs
python3 collect.py repos.jsonl                        # which repositories
python3 collect.py files.jsonl --files repos.jsonl    # which files, fetched raw
python3 report.py  files.jsonl repos.jsonl            # score them, offline
python3 index_out.py files.jsonl repos.jsonl          # build the published dataset

About twenty minutes end to end. CORPUS.md documents every query, every filename pattern, and what the sample is and is not.

Fetching and scoring are separate on purpose: rules get rewritten, and no revision of mine should cost strangers another few thousand requests.

What is in dataset/

index.jsonl	One row per instruction file: repo, path, branch, stars, size, sha256, and the raw URL. No bodies — the hash tells you whether the file you fetch today is the one I scanned, without me shipping a stale copy of somebody else's writing.
flagged.json	Every file that fired a rule, with verbatim text, because a claim about a file is not checkable without the file.
summary.json	The counts quoted in the write-up.

Scoring

Rules come from trapcheck, plus three detectors for invisible carriers: tag characters (reported decoded), bidi overrides (Trojan Source), and long runs of variation selectors.

A hit that matched only inside quotation marks is reported at half severity and flagged quoted, and counted separately from the headline. Every quoted hit in this survey was a repository quoting an attack in order to warn its own agent about it — which is what good practice looks like, and is not a finding.

Licence

MIT for the code. The dataset is an index of public metadata; the flagged excerpts are quoted from public repositories for the purpose of describing them.