When Your Archive Becomes the Prompt

Why old repository habits can quietly influence AI-assisted coding

I created an inbox folder in a workspace I share with Codex and dropped in a file called new_skills.md. It was a harmless reading list. Codex did not execute anything from it, but it kept offering to maintain it.

That small moment changed how I think about old text in an agentic workspace.

I noticed this while doing unrelated work in the Codex workspace, not while asking it to organize reading material. The new_skills.md file was simply sitting in an inbox folder as a list of articles and resources I wanted to review later. Even though Codex did not follow any instructions from the file, it began including unsolicited offers to update or maintain the list as part of its responses.

I did not run a controlled test by moving the file outside the workspace, renaming it, or explicitly excluding it from context, so I cannot say which of those changes would have stopped the behavior. My observation is narrower: once the file was present in the shared workspace, Codex repeatedly treated it as part of the work it might be responsible for.

Two different mechanisms

Some tools deliberately load instruction files. They may read a project guide, a skill manifest, or another documented configuration file before work begins. That is a product feature with a defined path.

Other material can still influence an agent because it becomes part of the context around a task. A file may be opened, surfaced by search, or mentioned in a nearby document. Its name and contents can make it appear current or relevant. That does not make the file an official instruction. It can still bend the agent’s judgment.

The difference matters. It keeps a useful observation from turning into a dramatic claim about prompt injection or hidden execution.

In my case, the simplest explanation is that new_skills.md looked relevant enough to attract attention. The agent then tried to be helpful in the direction the file suggested. That is a context-selection problem, not evidence that a reading list became a formal skill.

Why archive habits changed

For years, developers have kept old code, migration notes, decision memos, and abandoned plans in the working tree. The habit was messy, but most of those artifacts simply sat there. They might confuse a person during a search. They might complicate a refactor. They did not usually take part in the next conversation.

An agentic workflow changes that. An obsolete plan called current-plan.md, a stale migration guide, or a folder named skills can become background context when an agent is trying to understand a task. The file does not have magical power. Its influence depends on the tool, the task, the available context, and what the agent decides is relevant.

That is enough to make repository hygiene part of context engineering. A project needs a clear answer to a simple question: which documents describe current authority, and which ones are historical material that should not steer active work?

A small preflight

Before giving an agent broad freedom inside a repository:

1. Identify the documented instruction and configuration sources.
2. Mark the source of truth for current plans, decisions, and constraints.
3. Move true archives out of the active workspace when that is practical, or label them clearly as historical.
4. Start powerful tools with limited write scope and approvals.
5. Ask the agent what instructions and context it relied on before trusting an unexpected direction.

This is not a security compliance framework. It is a way to keep old material from quietly competing with the work in front of you.

The archive is still useful. It just is not necessarily inert.