so there's no flash<br>of the wrong palette before React hydrates. Mirrors the useTheme hook<br>(storage key "rw-theme"; classes rw-theme-dark|light|ascii). -->

AI Coding Clients Are Reading Each Other’s Personal Instructions - RuntimeWire

RuntimeWire

You're browsing RuntimeWire with JavaScript disabled. Articles and<br>navigation work fully. Interactive features — search, comments,<br>and newsletter signup — require JavaScript.

Why it matters

Coding agents are turning home-directory configuration into portable prompt context. Without approval before transfer, switching tools can expose instructions beyond the workspace a developer selected.

GitHub Copilot CLI should not have known which orchard was approved.

RuntimeWire had placed the answer -- COPILOT-CLAUDE-ORCHARD-5186 -- in ~/.claude/CLAUDE.md, Claude Code's personal instruction file under the test user's home directory. The selected workspace was empty. A baseline run returned None.

On the next default run, Copilot loaded the Claude file, included its instruction with the first remote prompt and returned the planted string exactly. When RuntimeWire repeated the prompt with Copilot's --no-custom-instructions switch, the file was excluded and the answer went back to None. The non-interactive default run displayed no notice before transmission.

The result followed RuntimeWire's Aug. 9 investigation of Meta's Muse Code. That reporting showed Muse placing complete personal Codex and Claude instructions into its first request to Meta by default. It prompted us to widen the test across other coding agents.

The expanded review produced three more live results. GitHub Copilot CLI, OpenCode and Grok each used the tested Claude personal instruction under their default settings. Cursor Agent's packaged JavaScript identifies personal Claude and Codex skill directories, recursively finds SKILL.md files and reads their contents when third-party extensibility is enabled.

The behavior varies substantially by product. Claude Code's tested import flow waited for confirmation before making a rival instruction active. Gemini CLI's compatibility was narrower and configurable. A static review of Kimi Desktop found a Chinese client loading extensive persistent context from its own designated workspace without a startup loader for rival personal directories.

That variation undercuts a defense that surfaced repeatedly after RuntimeWire's Muse report. Several Reddit commenters called cross-client loading an "industry standard." The tests show a collection of competing product choices instead. Some clients reached into another vendor's personal directory automatically. Others required configuration, asked first or stayed inside their own workspace. Calling the most permissive behavior an industry standard gives vendors cover that their own peers have already disproved.

The findings point to a product-design decision that users rarely see: whether compatibility with a competing agent reaches into personal files outside the directory they chose to open.

How coding clients handled rival personal files

Client<br>What happens by default<br>Does the user approve it first?<br>How RuntimeWire checked

Muse Code 0.1.0-R708.1<br>Reads personal Codex and Claude instructions and includes them with the first request to Meta<br>No. Muse displays a startup notice and offers a command-line opt-out<br>Live default and opt-out tests, plus an intercepted request

GitHub Copilot CLI 1.0.78<br>Reads ~/.claude/CLAUDE.md and includes it with the first remote prompt<br>No notice or approval appeared in the non-interactive test<br>Live baseline, default and disabled runs

OpenCode 1.18.15<br>Reads ~/.claude/CLAUDE.md and includes it with the default remote request<br>No notice or approval appeared<br>Live default and disabled runs

Grok 1.0.0 (3cd0d0cbce)<br>Reads ~/.claude/CLAUDE.md and includes it with the default remote prompt<br>No notice or approval appeared in the headless test<br>Live baseline, positive and removal-control runs, plus Grok's configuration inspection

Cursor Agent 2026.08.04-aaa8809<br>Searches personal Claude and Codex skill directories and reads matching SKILL.md files<br>No approval before local discovery was found. Remote transmission of every skill body remains unproven<br>Packaged JavaScript review

Claude Code 2.1.226<br>Leaves Codex and Gemini instructions inactive until the user imports them<br>Yes. The import flow offers preview, confirmation and per-item selection<br>Live import test

Gemini CLI 0.54.4<br>Uses GEMINI.md by default. A user can configure another filename such as AGENTS.md<br>Yes. Using the alternate filename requires a settings change<br>Documentation and code review

Kimi Desktop 3.1.5<br>Loads persistent instructions from its own OpenClaw workspace. No rival personal-directory loader was found<br>Not applicable. No cross-client personal-file access was found<br>Packaged JavaScript review

Qwen Code 0.21.8<br>Uses Qwen, project and shared .agents locations. No loader for Claude, Codex or Gemini personal directories was found<br>Not...