I stopped launching coding agents from ~/Downloads.
A planted AGENTS.md there can quietly tell the agent to install packages. In one public retest, Codex followed it most of the time.
Rule I keep now: cwd must be the project root, and I scan for stray AGENTS.md / CLAUDE.md before the first prompt. The folder is the trust boundary, not the chat box.