In our proof of concept, an attacker with contributor access to one project opens a pull request. The description is a normal-looking change; the hidden HTML comment carries the real prompt injection instructions.

The victim asks their coding agent to review it. From there, the tool-call trace tells the story:

1. The agent reads the PR description with hidden instructions.

2. Following those instructions, it calls pipelines_run_pipeline in a different project, one the attacker can't access.

3. It calls wiki_get_wiki_page_content to read a confidential wiki page in the same project.

4. It posts that content back as a comment on the attacker's PR, where the attacker can read it.

Notice that a single hidden comment drove a whole sequence, not one instruction, but a chain of legitimate tool calls ending in data leaving the project.

And that's the human-in-the-loop case

Everything above assumes a human in the loop, a person initiating the agentic PR review process.

Now picture where teams are actually heading. Agent workflows are being scaled and automated: PR reviews, triage, summaries, and follow-up tasks kicked off automatically by triggers, no human prompting each run and no human reading each result. In that world the injected PR description isn't waiting for someone to ask, it's an entry point that fires on its own. The more autonomous the pipeline, the wider the blast radius and the longer it goes unnoticed.

The harder problem: securing agents you can't see

Step back from this one bug and the pattern is uncomfortable. The agent did nothing "illegal", every tool call was one it was allowed to make. What went wrong was the sequence and intent, driven by text that a human never saw.

That's the shape of AI agent security in general, and it's why it's so hard for organizations to get ahead of. This bug is an example of what Simon Willison named the lethal trifecta:

• Access to private data: the agent holds the victim's credentials across projects.

• Exposure to untrusted content: it reads a PR description an attacker wrote.

• A way to send data out: it can post where the attacker will see it.

Each is harmless alone. Put all three in one agent and a single piece of untrusted text can turn its own permissions against its owner, and most genuinely useful agents have all three.

Guardrails like spotlighting help, but as this bug shows, coverage gaps are easy to miss and hard to audit at the source-code level. What you actually need is visibility into what agents do.

How Manifold helps

AI agents don't just answer questions anymore. They read, decide, and act – holding your credentials while they do it. And you trust them to, because that's the point.

The problem is that trust runs on a layer nothing else watches. Your EDR sees a CLI or a browser making ordinary API calls. Your gateway sees authenticated HTTPS to a service you allow. Neither sees an agent that just read an attacker's text and, seconds later, triggered a pipeline and opened a wiki it was never meant to touch.