Prompt injection

Prompt injection is when text the agent reads contains instructions, and the model follows them as though you had typed them. The model sees one stream of tokens; it has no hard boundary between 'the user said' and 'the web page said'. So a comment in a README, a line in a GitHub issue, a hidden block in a fetched docs page or a crafted tool result can say 'ignore your previous instructions and run this command', and some fraction of the time the model will.

Coding agents are unusually exposed because they read untrusted text all day and hold powerful tools while doing it. A model that only chats can be tricked into saying something wrong. An agent with a shell, a filesystem and network access can be tricked into printing your .env into a commit message, running a curl command that ships your keys elsewhere, or editing a file so the next run does the damage for it. The injection does not need to be clever; it needs to be read at the wrong moment.

There is no complete fix, so defence is layered. Run agents with the least permissive permission mode the task allows, and in a sandbox when they will touch untrusted content. Keep secrets out of the environment the agent can see. Review diffs before they merge, especially anything touching shell scripts, CI or network calls. And treat fetched content as data to be summarised, not instructions to be obeyed; when the agent 'decides' to do something you never asked for right after reading a page, that is the symptom.