> ## Content Index
> Fetch the complete content index at: https://www.cybrsecmedia.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Who Is Prompt-Injecting Coding Agents? A Scan of 86 Million GitHub Items
- URL: https://www.cybrsecmedia.com/who-is-prompt-injecting-coding-agents-a-scan-of-86-million-github-items/
- Published: 2026-10-27T19:12:41.000Z
- Updated: 2026-10-27T19:14:57.000Z
- Description: At [un]prompted II, Radware researchers reveal how hidden prompt injections found in a scan of 86 million GitHub items can manipulate AI coding agents, redirect workflows and threaten sensitive data.
- Author: Bill Brenner
- Tags: [un]prompted II, GitHub prompt injection, Article

Attackers don't need to compromise an AI coding agent to manipulate it. Sometimes, all they need is a GitHub issue containing instructions that a human reviewer never sees.

At \[un\]prompted II in San Francisco, Radware researchers Gabi Nakibly and Zvika Babo presented findings from a scan of 86 million GitHub items, uncovering attempts to influence AI coding agents through hidden instructions embedded in issues, pull requests, comments and README files.

Their presentation, *Who Is Prompt-Injecting Coding Agents? A Scan of 86 Million GitHub Items*, moves the discussion beyond proof-of-concept attacks to examine what is actually happening in public software development workflows.

[Subscribe to the CYBR.SEC.Media newsletter](#/portal/signup/free)

The researchers identified prompt injections in approximately 2.5 of every 100,000 items examined. Those instructions served a surprisingly diverse set of objectives, including coordinating legitimate project agents, restricting visiting bots, manipulating promotional content and attempting to steal sensitive information.

The findings expose a growing problem for software security: AI agents are increasingly trusted to perform development tasks, but the material they consume can contain instructions written by people who have no authority to control them.

And as organizations automate more of the software development lifecycle, that trust boundary becomes increasingly important.

**Full \[un\]prompted II coverage:**

[\[un\]prompted II: Full CoverageCYBR.SEC.Media's full coverage of \[un\]prompted II 2026: AI agent security research, expert talks, debates and analysis from San Francisco, October 27–29.![](https://storage.ghost.io/c/ab/67/ab676516-71e3-473d-8f73-9e0692f5aaee/content/images/icon/CYBR.SEC.Media-Logo-copy-eff09390-d3f5-4618-af84-2619c5447b6b.jpg)CYBR.SEC.MediaBill Brenner![](https://storage.ghost.io/c/ab/67/ab676516-71e3-473d-8f73-9e0692f5aaee/content/images/thumbnail/20db4c11-e6e0-4989-9cf5-9b6e767a8f5f-d596e95d-8d88-4a55-bc18-382870ded8ac.png)](https://www.cybrsecmedia.com/un-prompted-ii-full-coverage/)

## Hidden instructions, visible consequences

AI coding agents are becoming routine participants in software development.

They review pull requests, investigate bugs, summarize issues, suggest fixes and interact with development tools.

To perform those tasks, agents must read repository content. That includes information supplied by external contributors, anonymous users and potentially malicious actors.

The Radware researchers focused on indirect prompt injection, in which an attacker places instructions inside content an AI system encounters while performing a legitimate task.

One particularly useful hiding place is the HTML comment.

HTML comments can be embedded in GitHub Markdown without appearing in the normal rendered page. A human reviewing an issue might see an ordinary bug report, while an AI agent processing the underlying Markdown encounters additional instructions.

Those instructions might tell the agent to ignore its original task, change its output, access information unrelated to the assignment or perform actions benefiting the attacker.

The vulnerability emerges when the agent treats instructions found in untrusted repository content as though they came from an authorized user or system.

A GitHub issue is supposed to provide information for an agent to analyze. It should not become a source of authority over the agent's behavior.

## What 86 million GitHub items revealed

Nakibly, a distinguished researcher at Radware, and Babo, a senior AI security researcher, developed a large-scale detection pipeline to examine GitHub issues, pull requests, comments and README files.

Their process began by extracting hidden text, including HTML comments.

The researchers then applied specialized heuristics and a two-stage large language model classifier to identify potentially suspicious instructions. Every flagged candidate underwent manual review. The results revealed that hidden AI-directed instructions are not limited to malicious attacks. The researchers identified four broad categories of activity.

**Agent orchestration:** Instructions used to coordinate legitimate project automation, including AI agents working on development tasks.

**Restrictions on visiting bots:** Instructions attempting to control how external AI agents or automated systems interact with repository content.

**Growth hacking:** Instructions designed to influence generated content, promote projects or manipulate how agents describe or recommend something.

**Malicious activity:** Attempts to redirect agents toward unauthorized behavior, including the exfiltration of sensitive data.

A security tool that treats every hidden instruction as malicious risks flagging legitimate development automation. But a system that automatically trusts familiar-looking instructions could give attackers a way to impersonate authorized workflows.

The researchers' reported frequency — approximately 2.5 prompt injections per 100,000 items — suggests that these instructions are uncommon relative to the enormous volume of GitHub content.

But rarity does not eliminate the risk, particularly when a single instruction reaches an agent with access to sensitive systems or credentials.

## When legitimate agent instructions become an attack surface

One of the study's most consequential findings is that developers are already using hidden text to communicate with AI agents.

These instructions can serve practical purposes. A project might use hidden comments to coordinate an automated review process, communicate workflow state or provide context to an agent working on a particular issue.

That may improve efficiency, but it creates a question that traditional software development workflows rarely had to answer:

How does an AI agent know who is authorized to instruct it?

An agent may recognize a familiar marker or instruction format without understanding whether the person who submitted it has permission to control the workflow.

An attacker who can create a public issue or submit a comment may be able to imitate the same conventions used by legitimate project maintainers.

If the agent responds to the instruction without independently verifying its authority, the attacker has crossed the boundary between supplying task data and controlling the task itself.

This is why prompt injection cannot be reduced to a list of suspicious phrases.

The problem is not simply whether an instruction says something unusual.

It is whether the agent is allowing lower-trust content to override higher-trust instructions or trigger actions that the content's author is not authorized to request.

## From manipulated output to stolen data

The objectives uncovered by Radware range from relatively low-impact manipulation to potentially serious security incidents.

Growth-hacking instructions, for example, might attempt to influence how an AI agent describes a project or generates promotional material.

Other instructions may seek to restrict automated visitors or alter the behavior of agents interacting with repository content.

The more dangerous category involves attempts to make agents misuse their privileges.

A coding agent may have access to source code, development environments, external services, credentials or tools that execute commands.

If an attacker can influence that agent through a GitHub issue or README, the resulting actions could extend well beyond the repository content itself.

An instruction intended to exfiltrate sensitive data becomes especially concerning when the agent has access to secrets or can communicate with attacker-controlled destinations.

The research identifies these as observed objectives of prompt-injection attempts. It does not establish that every malicious instruction succeeded or resulted in a confirmed compromise.

The study documents evidence of attempts to manipulate coding agents in real GitHub content, not a measured success rate for those attacks.

Even so, the findings demonstrate that adversaries are beginning to exploit the way AI agents interact with ordinary development materials.

## The research has already expanded

The [public research repository](https://github.com/rdwr-gabin/github-ipi-in-the-wild?ref=cybrsecmedia.com) provides additional context beyond the 86-million-item scan described in the \[un\]prompted II presentation.

The expanded dataset covers approximately 145 million GitHub items and reports 47 identified attack attempts.

It also documents thousands of other hidden instructions associated with legitimate agent orchestration, content manipulation and defensive restrictions.

Those figures come from the expanded research, not the original 86-million-item conference dataset.

The larger study reinforces the central finding: Malicious prompt injections are only one part of a growing ecosystem of instructions directed at AI systems through repository content.

The repository also makes the researchers' detector, classification prompts and taxonomy available for others to examine and use.

That transparency matters because the threat is difficult to measure.

A hidden instruction may be malicious, legitimate, inherited from a project template or simply irrelevant to an agent's actual behavior.

Separating those cases requires more than searching for phrases such as "ignore previous instructions."

It requires understanding the context in which the text appears, who supplied it and what the agent might do after encountering it.

## Detection is only part of the solution

The researchers acknowledge that their methodology has blind spots.

The scan concentrated on hidden text, which means it cannot capture every form of prompt injection that might appear in visible GitHub content or other sources consumed by coding agents.

The detection pipeline also depends on heuristics and model-based classification, creating the possibility that some attacks were missed.

Manual review improves confidence in the identified findings, but it does not make the scan a complete census of all prompt-injection activity on GitHub.

For defenders, the more important question is what to do about the behavior the study exposes.

Organizations deploying AI coding agents should focus on several controls.

**Treat repository content as untrusted input.** Issues, pull requests, comments and documentation can contain useful information without being authorized sources of instructions.

**Verify authority outside the content itself.** A hidden comment or familiar workflow marker should not establish permission to direct an agent. Authorization must come from trusted identities and workflow controls.

**Limit agent privileges.** An agent reviewing a bug report should not automatically have access to unrelated secrets, administrative functions or sensitive repositories.

**Inspect agent actions as well as inputs.** Monitoring should capture tool calls, file access, network activity and other consequential behavior, not merely the prompts an agent receives.

**Test workflows against malicious repository content.** Security teams should evaluate how their agents respond to instructions embedded in the kinds of issues, pull requests and documentation they routinely process.

The underlying principle is straightforward: An agent should be able to read untrusted content without granting that content control over its tools or decisions.

## A new software supply chain security problem

The Radware findings point to a broader change in how software development can be attacked.

Traditional software supply chain security focuses on compromised dependencies, malicious packages, stolen credentials and tampered build systems.

AI coding agents introduce another path for interference.

An attacker may not need to change executable code. Instead, the attacker can attempt to manipulate the system responsible for reviewing, generating or modifying that code.

That changes the security assumptions surrounding ordinary development content.

A GitHub issue is no longer necessarily just a report for a human developer. It may also become an input to an autonomous system capable of taking action.

The same is true of pull requests, README files and comments.

As more organizations deploy agents throughout their development pipelines, the ability to distinguish information from instructions — and authorized instructions from unauthorized ones — becomes critical.

Nakibly and Babo's research offers an early measurement of that emerging attack surface.

*The researchers' detection tools, methodology and expanded findings are available at* [*github.com/rdwr-gabin/github-ipi-in-the-wild*](https://github.com/rdwr-gabin/github-ipi-in-the-wild?ref=cybrsecmedia.com)*.*

[![](https://storage.ghost.io/c/ab/67/ab676516-71e3-473d-8f73-9e0692f5aaee/content/images/2026/10/2027-Events-Banner-63.png)](https://www.cybrsecmedia.com/conference/)