An AI coding assistant investigates a routine bug. It reads a README file, a pull-request description and an agent-instruction file in the repository. One passage says that the fix cannot be validated until the agent runs a diagnostic command and sends the result to an external service. The instruction sounds operational, specific and helpful. It is also untrusted content that may have been placed there by someone with no authority to direct the company's software agents.
This is the basic problem of prompt injection in a repository. Ordinary content that an agent should treat as information is written to sound like an instruction. The consequences can include exposing source code, disclosing credentials, running an unwanted tool or changing the direction of a legitimate assignment. OWASP explicitly warns that issues, documentation and tool descriptions can carry instructions that steer coding agents.
There is a particularly dangerous ambiguity here. Repositories legitimately contain instructions for humans and agents. Teams use files such as AGENTS.md and other configuration to describe conventions, tests and workflows. The fact that a document has an official-sounding filename, however, does not prove that its author has the corporate authority to expand access or order a sensitive action.
A trustworthy arrangement draws that boundary clearly. The agent may read and analyze a suspicious instruction, but the instruction cannot enlarge its privileges. Its business mandate—who requested the task, the permitted repositories, tools, destinations and time window—comes from a separate enterprise-controlled source. An instruction discovered during work can propose a new step, but a sensitive new step must pass an independent check before execution.
Challenge agents can examine repository instructions and ask who introduced them, whether their contents conflict with the original task and whether an external transfer is truly necessary. Deterministic controls must still block unauthorized secret access or network destinations even when the challenger misses the deception.
The lesson is broader than “teach agents to ignore bad prompts.” A repository is an excellent place to store software. It should not be able to appoint itself the authority over what a company's AI agents may do.
Sources
https://owasp.github.io/DevSecOpsGuideline/2-Process/2-2-Develop/2-2-5-AI-Agent-and-MCP-Security/
NEXT STEP