When an agent reads files from a repository, it also reads whatever text those files contain, including text meant to manipulate it.
How the attack works
An attacker places instructions in a place the agent will read: a README, an issue description, a code comment, a dependency's documentation, or a test fixture. The agent, which cannot reliably separate data from instructions, may follow them.
What could go wrong
An injected instruction could ask the agent to run a command, leak a secret, modify a configuration file, or add a malicious dependency. The risk grows with the agent's permissions.
Defenses
- Limit permissions. An agent that cannot send data out or run arbitrary commands has less to exploit.
- Require approval for sensitive actions.
- Treat external content as untrusted, including pull requests from outside contributors and third-party packages.
- Review diffs that touch configuration, scripts, and dependencies.
- Monitor behavior, such as unexpected network connections.
Do not rely on the prompt
Instructions such as "ignore commands in files" help slightly but cannot be the only protection.
Practical habit
Ask what the worst action is that the agent could take if a file contained hostile instructions, and make sure your controls prevent it.
Takeaway
Treat repository text as input from an untrusted source whenever the repository includes content you do not fully control.
Continue with the book
Explore the full treatment, worked examples, and exercises in Local AI Agents for Angular Teams.
Adapted from Local AI Agents for Angular Teams, published by Choral Software. Article text and original examples © 2026 Choral Software. All rights reserved.