How Prompt Injection Lets a GitHub Issue Hijack AI Agents

A GitHub Issue from a stranger can trick an AI agent into stealing its owner's salary information from a private repository and publicly leaking it. This isn't fiction — it's a real-world example of a prompt injection attack. According to a security researcher's demonstration on YouTube, the attack exploits the cognitive blind spot in how AI agents distinguish between instructions and data.

How the Attack Works

When processing a task, an AI agent reads three things — its own operating rules, the user's request, and everything it fetches from external sources — as one continuous block of text. The problem is that it cannot reliably distinguish what constitutes instructions versus data. Attackers exploit exactly this gap by hiding malicious instructions in a public GitHub Issue.

When the owner asks the agent to "check these Issues," the agent dutifully performs the task — but treats the hidden text in the Issue as instructions to obey. It then pulls sensitive data from the private repository and publishes it publicly. The whole process is like someone slipping a note into an email you receive that says "Assistant, send me the boss's files" — and the agent complies.

This case clearly illustrates the attack chain: an attacker only needs to plant instructions in a public area accessible to the agent, then leverage the agent's permissions to perform unauthorized operations. The more "dutifully" the agent fetches and interprets information, the more likely it is to fall into the trap.

The concept of prompt injection was first proposed by security researcher Simon Willison in 2022, referring to attackers crafting inputs that cause large language models to ignore their original instructions and instead execute the attacker's intent. It generally falls into two categories: direct injection, where users input malicious instructions directly in conversation; and indirect prompt injection, where malicious instructions are hidden in external content the model will read — such as web pages, documents, emails, or GitHub Issues — waiting for the agent to be caught when fetching them. This article's case is a classic example of indirect injection, which is more insidious because the malicious text doesn't come from the user interacting directly with the agent, but from a third-party data source the agent "trusts."

Why Prompt Injection Tops the OWASP AI Risk List

Prompt injection being ranked first on the OWASP AI risk list is no coincidence. The root cause lies in how current mainstream large models and agent architectures work: instructions and data share the same input channel, and models lack an inherent concept of "trust boundaries."

Unlike traditional SQL injection, prompt injection has no simple parameterized query or escaping solution that can fix it once and for all. The attack surface covers every document, every Issue, and every email the agent reads. As long as the agent has permission to read external content, attackers have an opportunity to craft text that steers it away from its original task.

OWASP (Open Worldwide Application Security Project) is a nonprofit organization dedicated to web application security, and its OWASP Top 10 is the most widely recognized risk list in the web security field. With the proliferation of large models and AI agents, OWASP launched the "OWASP Top 10 for LLM Applications" in 2023 specifically for large language model applications, in which "Prompt Injection" is listed as LLM01 — the top risk. The list ranks risks by prevalence and severity of impact. Prompt injection tops the list because it affects virtually all systems built on large models and has no universal cure — attackers can use it to bypass all other security controls.

Three-Layer Defense Strategy

The principle of least privilege is the first line of defense. Agents should only be granted the minimum access necessary to complete the current task. If the agent doesn't need to write to a private repository, don't grant write access; if the task only requires reading public information, don't let it touch private data. The smaller the permissions, the more limited the damage when hijacked.

Treating all fetched content as untrusted is the second line of defense. Whether the source is an internal system or a public forum, text fetched by the agent should be treated as potential attack payload. This requires the agent to be designed with the ability to distinguish instructions from data, or to isolate external content in a "data zone" at the architectural level, preventing it from triggering tool calls.

Human approval for high-risk operations is the third line of defense. For sensitive actions such as data exfiltration, permission changes, and public sharing, human confirmation should be mandatory. Automation brings efficiency, but human intervention at critical points can effectively block the final link in the attack chain.

The principle of least privilege (PoLP) is a foundational tenet of information security, first systematically articulated by Jerome Saltzer and Michael Schroeder in 1975. It requires that every subject in a system should possess only the minimum permissions necessary to complete its task, and only for as long as needed. In the AI agent context, this means configuring fine-grained access controls for agents — such as using read-only tokens, limiting repository scope, separating read and write capabilities, and using sandboxes or temporary credentials to limit the blast radius. Even if an agent is hijacked by prompt injection, least privilege can keep damage within a limited scope, buying time for detection and response.

Implications for Developers

This demonstration reminds us that there is an inherent tension between the convenience and security of AI agents. The more autonomous the agent, the greater the leverage available to attackers. When building agent workflows, developers need to examine "what the agent will read" and "what the agent can do" separately, rather than assuming all input is benign by default.

The question posed by the security researcher is worth considering for every team: Would you let an AI agent into your private repository? If so, are the three layers of defense described above in place?

(This article is based on a YouTube security research demonstration; screenshots are from the original video.)