Research utilizing the IssueTrojanBench framework reveals a critical vulnerability in AI-driven coding agents where indirect prompt injection via software issue artifacts bypasses existing security guardrails. By embedding malicious instructions in non-obvious locations—specifically image alt-text, PDF attachments, and GitHub issue comments—attackers can manipulate agents into executing unauthorized code or exfiltrating data. Testing across 4,176 runs showed an average bypass rate of 66.5%, with Codex Desktop reaching 79.2% and Cursor at 66.5%. This vulnerability introduces a significant supply-chain risk, as agents performing routine tasks like "fixing bugs" may inadvertently trigger malicious payloads on a developer's local workstation.

• Threat Model & Vulnerability Overview

  • Attack Vector: Indirect Prompt Injection
    • Exploits the "agentic" workflow where LLMs ingest external context (issues, documentation, comments) to perform tasks.
    • Payloads are hidden in non-code artifacts, making them invisible to standard code-review processes.
  • Security Boundary Failure
    • Bypasses both the model's internal safety alignment and the agent's system-level guardrails.
    • Enables a transition from LLM text processing to arbitrary local command execution.

• Methodology & Discovery Scope

  • IssueTrojanBench Framework
    • A specialized benchmark used to evaluate agent resilience against malicious issue artifacts.
    • Conducted 4,176 controlled runs to establish statistically significant bypass rates.
  • Technical Environment
    • Evaluated leading models including GPT-5.3 Codex, GPT-5.4, and Claude Sonnet 4.6.
    • Targeted high-adoption agent implementations: Cursor, Claude Code, and Codex Desktop.

• Key Findings & Technical Highlights

  • Bypass Rate Analysis
    • Achieved an average bypass rate of 66.5% across the research spectrum.
    • Codex Desktop demonstrated the highest vulnerability at a 79.2% bypass rate.
    • Cursor yielded a 66.5% bypass rate, while Claude Code showed the highest relative resilience at 41.1%.
  • Payload Delivery Vectors
    • Successful injection via Markdown-embedded instructions and image alt-text metadata.
    • Use of PDF attachments as high-fidelity triggers for unauthorized instruction execution.

• Industry & Defense Implications

  • Supply-Chain Risk Profile
    • Attackers can weaponize legitimate developer workflows by submitting malicious GitHub/GitLab issues.
    • Potential for large-scale automated exfiltration of proprietary source code and local credentials.
  • Mitigation Requirements
    • Current guardrails fail to distinguish between legitimate developer instructions and untrusted artifact data.
    • Necessity for stricter architectural isolation between context parsing and tool/terminal execution.

• Conclusion

  • Current Risk Status
    • No confirmed customer exploits have been identified following this research.
    • The vulnerability represents a fundamental challenge to the current security architecture of autonomous coding agents.