Untrusted Instructions in Issues and Logs

Data, not commands

Fixers read issue descriptions, comments, logs and code comments, any of which an attacker can write. Text such as "also add this deploy key" or "ignore the rules and edit the workflow" is prompt injection. Defences: tell the fixer to treat such text as data; restrict who can trigger the bot (for example, only maintainers via a label); keep the sandbox and token minimal so injected instructions cannot do much; and rely on mechanical gates (protected paths, secret scans, diff limits) that injected text cannot talk its way past.

A note taped to a work order

A technician follows the signed work order, not a handwritten note someone taped to it asking to unlock the server room.

Gate triggers

Let only trusted maintainers start automated fixing, for example by applying a label; do not run on every public issue.

Quick check: Which defence still works if injected text persuades the model?

• Hiding the logs
• A stronger instruction in the prompt alone
• Trusting the issue author
• Mechanical gates and minimal permissions