Claude Code was fetching pages for me during a research session, one of them a GitHub repository page. Buried in the middle of the fetched text, between the project description and the install instructions, sat a <system-reminder> tag telling the agent that the date had changed.
It hadn't. There is a real mechanism that delivers system reminders to Claude Code, and it had nothing to do with this one. A person typed that tag into a README, guessing that some AI agent would eventually read the page and mistake the text for a message from its own runtime.
That was the entire attack. Plain text on a normal-looking repo, shaped like something an agent is trained to obey. No exploit, no malicious package.
The README is an attack surface
Fetch a GitHub repo page and you get the rendered README with it. That text is user controlled. Anyone can put anything there, and the fact that the page came from github.com over a valid certificate tells you nothing about it. The host is reputable. The content is whatever some stranger wrote. The trust boundary runs through the middle of the page, which is an uncomfortable place for a trust boundary to be.
