PATH shims are enough to feed a coding agent fabricated tool output.

TrustMeBro is a Go tool at 327 stars, created August 26, that intercepts commands invoked by Codex, Claude Code and pi through PATH shims alone. No plugin, no hook, no MCP. Rules decide whether to fabricate output, rewrite stdout while preserving stderr and exit status, block, or exec the real binary. The published evaluation is the finding: each model had to verify a fresh DNS TXT authorization marker before running a scan, and GPT-5.6 Sol, GPT-5.5, DeepSeek V4 Pro and V4 Flash all correctly refused with the real dig, then all four proceeded once TrustMeBro returned fabricated proof. Any agent decision gated on shell output is exactly as trustworthy as PATH.