Skip to main content

AI Coding Agents

AI coding agents operate autonomously — reading files, running commands, and making multi-file changes. Because they take more independent action than chat-based assistants, embedding security prompts into their configuration is especially important.

Each setup below starts with the prompt for your technology, for example prompts/python/django/5.2/prompt.md. Re-copy it after each release; see Prompt Delivery.

Claude Code​

Claude Code reads project instructions from CLAUDE.md. See Claude Code for setup.

OpenAI Codex​

Codex is OpenAI's coding agent. It runs in the cloud, as a CLI, and as an IDE extension, and reads project instructions from AGENTS.md files.

Setup with AGENTS.md​

Create an AGENTS.md file in your project root:

cp path/to/prompt-repo/prompts/python/django/5.2/prompt.md AGENTS.md

Codex reads AGENTS.md when it starts a task in your repository.

Tips​

  • Codex cloud tasks run in a sandbox that clones your repository — the AGENTS.md file must be committed
  • Codex supports AGENTS.md files in subdirectories; files closer to the working directory take priority
  • For personal defaults across all projects, use ~/.codex/AGENTS.md

Cursor Agent Mode​

Cursor Agent mode reads the same project rules as the rest of Cursor. See Cursor for setup. Rules with alwaysApply: true are included in every Agent session, so security guidance shapes the whole multi-step plan.

Aider​

Aider is an open-source AI pair programming tool that works from the terminal.

Setup with Configuration​

Create a .aider.conf.yml file in your project root:

read:
  - path/to/prompt-repo/prompts/python/django/5.2/prompt.md

Or pass the prompt at launch:

aider --read path/to/prompt-repo/prompts/python/django/5.2/prompt.md

Tips​

  • The --read flag loads files as read-only context, which is ideal for security prompts
  • Aider doesn't load any instructions file on its own; use --read or the read: setting
  • Works with Claude, GPT, Gemini, and other model backends

Devin Desktop (formerly Windsurf)​

Devin Desktop, formerly Windsurf, runs local and cloud agents that read project rules from .devin/rules/ and AGENTS.md. See Devin Desktop for setup.

Kiro CLI​

Kiro CLI replaced the Amazon Q Developer CLI. It reads the same steering files as the Kiro IDE, and AGENTS.md from the project root. See Kiro for setup.

General Pattern for Coding Agents​

Most AI coding agents follow one of two patterns:

PatternExamplesHow to configure
Markdown file in repoClaude Code (CLAUDE.md), Codex (AGENTS.md), Kiro (AGENTS.md)Create the file with the prompt content
Rules directoryCursor (.cursor/rules/), Devin Desktop (.devin/rules/), Kiro (.kiro/steering/)Add a rule file in the directory

In either case:

  1. Paste the full security prompt into the designated file
  2. Commit the file to version control
  3. The agent reads it automatically on every session
  4. Updates take effect on the next session start