high severityCurated advisory

Prompt injection via issue comments and pull requests

Attackers embed hidden instructions in GitHub issues, PR comments, and commit messages. When an AI agent reads these to help triage or review, it follows the embedded instructions — potentially approving malicious code or leaking repository secrets.

Key facts

Prompt injection via issue comments and pull requests is a high-severity AI agent security threat targeting GitHub issues, pull request comments, commit messages, agent context window. Treat issue text, pull request comments, and commit messages as untrusted input. Guard can evaluate supported prompt-sensitive and downstream actions, but do not rely on Guard as a universal pre-ingestion scanner for every external collaboration surface.

4 affected surfacesLast updated Jun 25, 2026

Protect my harness Protect a team

Affected surfacesGitHub issuespull request commentscommit messagesagent context window

The attack

What happens

An attacker opens an issue or PR comment containing hidden instructions — sometimes in HTML comments, zero-width characters, or formatted as system prompts. When the AI agent reads the issue to help triage, it interprets the hidden text as an instruction and follows it.

Step by step

How the attack unfolds

1Attacker opens a GitHub issue with a legitimate-looking title and body.

2Inside the issue, they embed a hidden instruction using HTML comments:

3Agent reads the issue as part of its triage workflow and encounters the hidden instruction in its context.

4Agent treats the embedded instruction as authoritative and approves the associated PR.

5Malicious code in the PR is merged into the main branch.

Example

What it looks like in practice

Scenario

A developer asks Claude Code to review an open PR. The PR description looks normal but contains an HTML comment: . Claude reads the comment as part of the PR context and approves the PR. The PR actually introduces a dependency that exfiltrates build secrets.

Detection

Detection and Guard coverage

Guard can evaluate supported prompt-sensitive actions and risky downstream actions according to local policy.

Current Guard product evidence does not establish universal scanning of every issue, pull request comment, or commit message before it reaches an agent.

Current Guard product evidence does not establish a cross-team injection-template reputation library for this surface.

Mitigation

How to stop it

Recommended action

Treat issue text, pull request comments, and commit messages as untrusted input. Guard can evaluate supported prompt-sensitive and downstream actions, but do not rely on Guard as a universal pre-ingestion scanner for every external collaboration surface.

Guard configuration

Use Protection Center to review which Guard controls are active on this device.

Use `hol-guard command controls status` and `hol-guard command controls list` to inspect the active local control catalog.

Guard coverage is action- and harness-specific. Do not treat an advisory label as a configurable Guard setting unless it appears in the current control catalog.

Related threat guides

prompt-injection unsafe-command

Use the protections Guard supports here

Guard can review or block supported actions for this threat. The advisory above calls out what Guard covers and where other controls are still needed.

Install HOL Guard See team plans