AI coding agents can't tell the difference between a legitimate bug report and one with hidden instructions buried inside it. That gap is now being exploited at scale.
The Incident
Researchers have documented a class of attack being called "Agentjacking" — attackers embed hidden adversarial instructions inside fake bug reports and feed them to AI coding agents. Because these agents are designed to read, understand, and act on issue content, they execute the attacker-controlled commands as though they were legitimate tasks.
The attack surface is broad: any agentic workflow that ingests external content — GitHub issues, Jira tickets, support emails, code review comments — is potentially in scope. The effort to mount one of these attacks is trivially low. Write a bug report, embed an instruction, submit it. The agent does the rest.
This isn't a theoretical edge case. It's a scalable, low-effort exploitation of the fundamental trust model that agentic AI systems are built on: the agent assumes that what it reads is authoritative.
