No CVE needed: how a GitHub issue hijacked an AI agent

A recent security analysis highlights a critical vulnerability in AI agents that interact with GitHub repositories. The attack, which does not require a CVE or traditional exploit, uses indirect prompt injection via public GitHub issues. By embedding malicious instructions within an issue's text, an attacker can trick an AI agent into performing unauthorized actions, such as accessing private repositories or exfiltrating sensitive data. Because the agent treats all ingested text as instructions, it cannot distinguish between user commands and malicious payloads hidden in public data. Security researchers emphasize that this is an architectural flaw rather than a software bug. To mitigate these risks, experts recommend maintaining strict human-in-the-loop approval for tool calls, using scoped access tokens, and separating read and write permissions for agents. This incident underscores the urgent need for better security boundaries when integrating AI agents with external data sources.