Their complete contents are added to the first model request and sent to the client's servers by default.
At startup, the client displays a brief notice saying it is including the other clients' personal rules. It does not ask permission first. A command-line option disables the behavior.
The configuration guide says: "Your machine-wide user rules always load." It requires users to trust a workspace before loading project instruction files. The machine-wide files load automatically.
I tested this by placing a harmless canary instruction in ~/.codex/AGENTS.md. The client followed it during a default run. It did not follow it when foreign personal context was disabled.
These files can contain internal coding standards, infrastructure references, project details, or credentials someone pasted and forgot about.
Is the startup notice enough disclosure? Does describing the behavior in the documentation amount to consent? Would you expect one coding client to read files from another vendor's configuration directory and send them with the first request?