Your README can prompt your AI assistant

Indirect prompt injection against coding assistants, and the layered defenses that limit the damage.

The post

Your AI pair programmer has a new attack surface. You didn't prompt the attack—your README did.

Researchers have been documenting something called indirect prompt injection. The model doesn't only follow what you type. It reads your repo, your config, your GitHub issues, even Mermaid diagrams in docs. Attackers hide instructions inside that content. When the AI ingests it, it obeys. Steal API keys. Run blocked commands. Exfiltrate env vars. In some cases, push malicious code to the repo. No popup. No "are you sure?" Just the model doing what the hidden prompt said.

We've seen it in the wild: Copilot, Cursor, Codespaces. One vector is a poisoned settings file that flips the assistant into a mode where it runs commands without confirmation. Another is a README or an issue with invisible instructions that tell the model to send secrets to an attacker URL or run a curl. Another is an agent that can run git push—tricked into whitelisting a dangerous command and pushing bad code. RCE, secret theft, supply chain. All from content the AI "helpfully" read.

The trust boundary isn't just your code anymore. It's every file and channel the model sees. So: treat what the AI reads as untrusted input. Don't paste untrusted docs or config into context. Review what's in the repos and issues the assistant has access to. And think in layers—IDE and config hygiene, CI/CD gates so the agent can't push without review, and least-privilege tokens so a leak doesn't hand over the whole org. Single-layer defense isn't enough.

If you're shipping with Copilot, Cursor, or similar: what's one thing you've changed (or would change) in how you use them or what you let them read?