Malicious GitHub Issue Injection Against Coding Agents

Description

IssueTrojanBench studies indirect prompt injection when a coding agent processes an apparently ordinary software-development issue or related artifact. Starting with six legitimate seed issues from two Python repositories, the authors construct 696 adversarial issue variants spanning four unsafe-action families and six delivery formats, then execute those variants across six agent-model configurations.

Examples

Defensive evaluation should use isolated copies of the two benchmark repositories, inert package and persistence operations, synthetic issue content, and observable allow-or-deny decisions; see https://arxiv.org/html/2607.20759 (opens in a new tab).

Impact

The paper reports 2,776 unsafe-action executions across 4,176 runs (66.5%). The rate describes generated variants of only six seed issues from two repositories, one developer task prompt, and the authors’ tested client snapshots; it does not establish a current production vulnerability, a representative real-world issue distribution, or an intrinsic vendor ranking.

Affected Systems

• Cursor, Claude Code, and Codex Desktop in the paper’s evaluated configurations
• Coding-agent workflows that consume GitHub issues, issue comments, PDFs, websites, source files, or image metadata
• Dependency installation, repository configuration, persistence-related file changes, and resource-management workflows

Mitigation Steps

• Treat issue text, comments, attachments, websites, and repository content as untrusted data rather than additional developer instructions.
• Separate trusted user authorization from issue-provided requests and enforce scoped tool permissions before side effects.
• Require explicit review for dependency changes, security-configuration edits, persistence mechanisms, and resource-intensive commands.
• Bind approval dialogs to the actual command, destination, affected files, and source provenance.
• Validate defenses on diverse independently selected repositories and issues instead of extrapolating from the paper’s six seed cases.

Evidence

• https://arxiv.org/html/2607.20759 (opens in a new tab) — Benchmark construction starts from six seed issues in the SymPy and requests repositories and expands them into 696 issue artifacts.
• https://arxiv.org/html/2607.20759 (opens in a new tab) — Table III and the susceptibility results report 2,776 unsafe executions across 4,176 evaluated runs.
• https://arxiv.org/html/2607.20759 (opens in a new tab) — Table III directly identifies GPT-5.3 Codex, GPT-5.4, and Sonnet 4.6 as the tested foundation models, separate from the three agent products.
• https://arxiv.org/html/2607.20759 (opens in a new tab) — Discussion and threats to validity limit the findings to two repositories, generated perturbations, evaluated agent snapshots, and the selected task prompt.