The census scanned tens of millions of GitHub content items for instructions that are hidden from normal code review but visible to automated agents. It distinguished first-party coordination and innocuous templates from cases where source text tried to redirect an assistant. The reported figures include 2,281 confirmed hidden agent-directed messages, but…
Inspect the ClaimsCase · DiggingBeagle record
A large GitHub content census found rare, distinct hidden agent-injection attempts
Research scanning GitHub issues, pull requests and READMEs found numerous suspicious strings but few verified hostile attempts after manual filtering.
Scope
GitHub content census and manually screened candidate strings; no verified downstream compromise rate is established from the occurrence counts.
Assessment profile
Assessment method- Setting
- production
- Exploitation
- not established
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
The census counts observed GitHub messages and classified intentions, not verified execution or victim compromise. Impact remains unrated because the scoped record does not establish a calibrated severity-to-impact-band mapping.
Assessed Oct 31, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-C26-GITHUB-HIDDEN-INJECTION-CENSUS-1 · GitHub repository: hidden prompt injection census of issues, PRs, and READMEs
At a glance
The 2,281 hidden instances and forty-seven hostile attempts have different definitions and cannot become a model-compromise rate.
Read the implicationsAutomated classifier false positives and dataset selection limit external prevalence estimates. The ultimate actions taken by agents encountering each hostile string were not observed.
Limits and uncertaintyFull account
The census scanned tens of millions of GitHub content items for instructions that are hidden from normal code review but visible to automated agents. It distinguished first-party coordination and innocuous templates from cases where source text tried to redirect an assistant. The reported figures include 2,281 confirmed hidden agent-directed messages, but only forty-seven classified as hostile attempts in the cited sample and categories. That separation matters: hidden text is not automatically an attack, and a prompt-injection attempt is not a successful tool compromise.
Different GitHub surfaces also grant different trust levels. A README may provide repository instructions an agent expects to read, while an issue or pull request can be written by an untrusted contributor. The decisive boundary is whether a retrieved instruction is promoted into authority over file changes, shell commands or credentials. The census supports prevalence estimates for its sample and period, not a global compromise rate.
Mechanism and trust boundary
- 01
Step
- 02
Step
- 03
Step
Timeline
- Oct 29, 2026disclosure
Public disclosure
Claims & evidence
CLM-C26-GITHUB-HIDDEN-INJECTION-CENSUS-1The public census reports 2,281 hidden agent-directed message instances and a much smaller set of forty-seven hostile attempts after categorization; these are not confirmed compromises.supported
Basis: reported finding
- supportsGitHub repository: hidden prompt injection census of issues, PRs, and READMEsprimary disclosure
GitHub research repository, corpus counts, classification review and hostile-attempt categories
Implications
The 2,281 hidden instances and forty-seven hostile attempts have different definitions and cannot become a model-compromise rate.
Controls and mitigations
- Render hidden bytes and provenance in agent reviews; treat issues, PRs and source files as untrusted until action authority is independently checked.
Unknowns and contradictions
- Automated classifier false positives and dataset selection limit external prevalence estimates.
- The ultimate actions taken by agents encountering each hostile string were not observed.
Sources and citation
Material revision history
- Oct 31, 2026 · Canonical change recorded · new in release · revision 208