The boundary
Coding agents routinely read code comments, issue descriptions, web pages, dependency documentation, and tool responses. Some of that material can be edited by an adversary. OWASP's prompt-injection guidance describes indirect attacks in precisely these carriers: content meant to be inspected may contain instructions to change the assistant's behavior. The trusted instruction is the user's authorized task and governing policy; encountered text is evidence for that task. A repository README may be useful context, but its presence alone does not grant authority to reveal secrets or call an outside service.
Why a warning in the prompt is insufficient
The model still has to read untrusted material to perform the task, and language can blur instructions with facts. An attacker can hide a command in a comment that looks like a maintenance note or in a web result that looks like an official procedure. OWASP recommends layered controls including separation of trusted and untrusted content, output validation, least privilege, and human oversight. These controls reduce exposure and consequence; they are not a mathematical proof that every malicious instruction will be ignored.
Constrain the consequence
A safer workflow gives the agent only the files and tools needed for the assignment. Sensitive values should not be in the agent's ordinary context, and external-write tools should require a separately reviewable action. Treat retrieved commands as proposals to verify, not commands to execute automatically. For example, a package's installation guide can inform a build step, but a sudden request to upload an environment file is outside a normal documentation role. This distinction is an editorial control pattern based on the trust-boundary model, not a claim of a test performed here.
Test the workflow, not just the model
Place harmless adversarial text in the kinds of surfaces the agent will actually encounter: an issue, a code comment, a tool response, or a retrieved page. Check whether it changes the plan, causes an unauthorized tool call, or contaminates the final answer. Record the exact payload, permissions, and observed behavior if such a test is conducted. No such test was run for this article. The design question is whether the workflow can contain a model mistake. Keeping write access narrow is useful even when the model correctly recognizes the attack.
What to carry into the work
- Identify every lower-trust input surface.
- Keep encountered instructions from changing task authority.
- Restrict tools and secrets to the assignment.
- Use harmless injection fixtures in future workflow testing.
Sources & dates
- LLM Prompt Injection Prevention Cheat Sheet ↗OWASP · Undated source · Checked 16 Sept 2026
- AI RMF Generative AI Profile ↗NIST · Undated source · Checked 16 Sept 2026
Unknown source dates stay undated. Preparation is not publication; no historical byline or interview is implied.