Devs are relying more on them for code review, and less on manual line-by-line checks.
But this leaves coding agents vulnerable to indirect injection attacks.
IssueTrojanBench (arxiv 2607.20759) studies this in the context of malicious issue requests.
I also observed these prompt injection vulnerabilities in my own harness, testing on the issue: https://github.com/smellslikeml/curator/issues/3
But even red teaming your own repos with toy examples like this can trigger AI safeguards and corrupt your session.
Adopting popular mitigation techniques like 'spotlighting' and 'known answer detection' can help but the researchers show it's not enough.
So our latest updates to Outrider implement additional layers for greater defense-in-depth to ensure that by time a human has to review the code, we've filtered this kind noise.