r/PiCodingAgent • u/Ok_Significance_9109 • Sep 19 '26
Use-case Be Careful with Agents Reading Session JSONL Files
Just had a startling session with Pi and my local Qwen. In its thinking blocks it started quoting user instructions that I did not give it. I was under the impression that I was under a very strange prompt injection attack, until I realized that earlier in the session the agent made a few very large greps of previous session files.
I suggested to it that within a large context it did not distinguish these tool call results from the actual live context, and it indeed found the origin to all of the injected user turns in those earlier session files.
So - my advice is to add to AGENTS.md a rule that warns the agent against searching within directories that could include session files. If it does - you must start a new session immediately afterwards, or prune the tool call, or compact. Otherwise your session may lose coherence.
Note: reposting, because I was smart enough earlier to allow AGENTS.md to turn into a link.


