A researcher shows a malicious README that makes our coding agent leak secrets. What went wrong, and what do you change?

Make your call first. Use the published answer and rubric to examine your reasoning when you are ready.