Prompt-injected open-source library reportedly hijacked security-review agents for code execution: why it is not safe to use

What happened

Permission Protocol's incident tracker says a July 8, 2026 disclosure described a proof of concept from the AI Now Institute. It reportedly showed that prompt injections, meaning hidden instructions aimed at an AI system, could be spread across normal-looking source files in an open-source library. In that setup, security-review agents could be hijacked and pushed toward remote code execution paths, meaning the agent may end up running code on a system. The tracker names Claude Code and OpenAI Codex CLI among the affected agent types and labels the issue as a tool-call gate problem, which means the checks around when an agent can use tools were not strong enough.

A separate July 20, 2026 technical write-up described the same broad pattern. It said one malicious GitHub issue or repository file can disrupt agent-based CI/CD workflows if the agent has write access, shell access, or network access.

What it means for you

If you ask an AI agent to inspect outside code or issues, the content itself may contain instructions meant for the agent, not for you. The main risk is trusting the agent to safely review third-party material when it may instead be manipulated by that material.

What to do instead

Treat third-party repositories and issue threads as untrusted input. Avoid giving review agents write, shell, or network access unless you truly need it. Use read-only review steps first. Ask the agent to summarize findings before taking actions. Keep approvals on for tool use where possible. AgentPod lists only reviewed, tested skills, but that does not remove the need to limit access and verify what an agent is being asked to do.

Sources:

• https://www.permissionprotocol.com/agent-incident-tracker
• https://codex.danielvaughan.com/2026/07/20/comment-and-control-ci-cd-prompt-injection-claude-code-action-codex-cli-github-actions-defence/