Yes and the bigger problem for me is the agent can write to that file too. The file that decides what it is allowed to do is just another file in the repo for it. I now treat the agent config files as something to protect from the agent itself, not only from other people.