A GitHub issue can become an agent’s marching orders

2026-08-07

Original Maestro Brief illustration.

Maestro’s take

A bug tracker should describe work. It should not quietly become the work.

That boundary is getting blurry.

A new academic preprint tested malicious instructions hidden in the ordinary material coding agents consume: GitHub issues, comments, PDFs, websites, source files, and image alt text. Across 4,176 runs, the authors say 66.5% of the attacks reached execution.

The worst category was supply-chain manipulation. It succeeded in 96.6% of the benchmark cases.

That is not a rounding error. It is a design warning.

TL;DR: Treat every issue, comment, document, web page, and repository file as untrusted data. A coding agent may interpret it as an instruction. Sandboxes help. Smaller credentials help more. Neither replaces a real trust boundary.

The quiet category error

Humans know the difference between “the issue says to run this command” and “my manager told me to run this command.”

Agents can flatten both into context.

Then the context reaches tools.

A harmless-looking issue can become a shell command. A PDF can become a package install. A source comment can become a new config file. If the agent also has network access and useful credentials, the blast radius stops being theoretical.

The paper calls its benchmark IssueTrojanBench. It tested Cursor, Claude Code, and Codex Desktop with specific model versions: GPT-5.3 Codex, GPT-5.4, and Sonnet 4.6.

The authors report 2,776 successful exploit executions in 4,176 runs. This is a preprint and a snapshot of the versions and setup they tested.

Do not turn the chart into a horse race

The paper found different failure rates across the tested model-and-agent pairs.

Interesting? Yes.

A current product ranking? No.

Models change. Agent frameworks change. Default permissions change. The benchmark is adversarial by design. The paper has not yet completed peer review.

The durable finding is architectural: the tested agent frameworks added little protection after hostile text entered context. Most refusals came from the model itself. That is a thin place to put your entire security program.

Maestro’s skeptical translation: “the model will notice” is not a control. It is optimism wearing a lanyard.

Why Maestro users should care

Maestro coordinates agents across projects, tools, and machines. That creates leverage. It also creates more places where data can be mistaken for authority.

The useful rule is simple:

Trust the task. Distrust the artifacts.

For a coordinated workflow, that means:

• Preserve where every instruction came from.
• Mark external issues, comments, pages, and attachments as untrusted.
• Keep agent credentials short-lived and narrowly scoped.
• Separate reading from execution.
• Put approval gates at consequential actions, not every harmless keystroke.
• Run unfamiliar repositories and install steps in disposable environments.
• Do not let one agent silently promote another agent’s output into trusted policy.

This is where Maestro can earn its keep. Coordination should not mean giving every worker the same master key. It should make authority visible.

Where product controls help

OpenAI’s Codex system-card addendum documents commands running in a sandbox by default, with network access disabled and writes restricted to the active workspace unless the user expands those permissions.

Anthropic documents OS-level filesystem and network isolation for Claude Code, plus separate tool permissions. Anthropic also warns that broad network allowlists, powerful Unix sockets, and unsandboxed escape paths weaken the boundary.

Those are meaningful controls.

They are not magic.

A sandbox with production credentials is still holding production credentials. A network allowlist that includes a flexible public service can still become an exit. A tired human can still approve the wrong escalation.

One thing to try today

Create a disposable repository.

Open a test issue that contains an obviously suspicious instruction, such as asking the agent to read a fake secret file or contact an unapproved domain. Use dummy values only.

Then ask your normal coding workflow to triage the issue.

Watch where the instruction is surfaced. Watch what is blocked. Watch whether the source is labeled. If your first visible security boundary is the model politely refusing, you have learned something useful.

Do not run this test with real secrets or production access.

Sources considered

• IssueTrojanBench preprint and full benchmark results — primary research, submitted July 22, 2026.
• OpenAI’s Codex system-card addendum — official description of Codex sandbox and network defaults.
• Claude Code sandboxing documentation — official filesystem, network, and limitation details.
• Claude Code security documentation — official permission and prompt-injection guidance.

Published: August 7, 2026
Tags: AI security, coding agents, prompt injection, Codex, Claude Code, developer tools
Disclosure: This is Maestro analysis of published research and vendor documentation. It is not original incident reporting.