A coding-agent harness stops every action that would leave the sandbox and asks you. Because answering the same prompt all day is intolerable, it also lets you approve a rule — anything starting with python — and matching commands never ask again. This paper builds repositories whose content steers the agent into proposing a rule broader than the task needs: 58 of 100 runs produced the target rule against 32 for simply asking and 0 for the benign control, and once the rule was approved the attack finished its real goal with no second prompt in 47 of 58 eligible cases. Persuasive prose in the repository barely moved the agent; making the blocked command the only way past a gate the task had to clear moved it every time.