In the not too distant past we told devs “Don’t run code from strangers.” Now, with autonomous AI coding agents reading repositories, running commands, opening PRs, and inheriting developer credentials, the updated rule is:

→ Don’t let an autonomous tool read instructions from strangers while holding your shell, your repo token, and your cloud credentials. It’s a trust boundary problem ready to be exploited.

The way it works is that attackers plant malicious instructions in places AI agents routinely read:

• – README files – GitHub issues & PR comments – Bug reports – Makefiles / setup scripts – MCP tool outputs

The agent interprets that content as actionable instructions and executes commands with your developer or CI/CD privileges.

Theft of GitHub tokens, AWS keys, SSH keys, CI/CD secrets, or private source code. As Tenet Security’s “agentjacking” research demonstrated, a single poisoned bug report can hijack an AI coding agent into fetching attacker-supplied data and executing attacker-controlled code on a developer machine.

The Cloud Security Alliance also flagged this pattern, AI agents embedded in GitHub Actions, processing untrusted repo content while holding write access and pipeline secrets.

The takeaway is that prompt injection becomes a supply-chain risk the moment the model has tools. OWASP defines this as indirect prompt injection; malicious instructions from external sources that can lead to unauthorized access and arbitrary command execution.

If you are a developer:

→ Never run AI agents in auto-execute/YOLO mode on unfamiliar repositories

→ Treat README files, issues, PR comments, and error messages as untrusted input 

→ Run unknown projects in a disposable container, VM, or cloud dev environment

→ Keep GitHub tokens, SSH keys, and cloud credentials out of the agent environment

→ Require explicit approval before shell commands, dependency installs, network calls, or file deletions

I think we have reached our JFK moment here, don’t ask “what can the agent do for me?” but “What can the agent read, what can it do, what credentials does it inherit, and who approves the action?”

Sources: Cloud Security Alliance · Dark Reading / Tenet Security · OWASP