66% of malicious GitHub issues bypass AI coding agent guardrails
If your team is handing GitHub issues directly to an AI coding agent, a new research benchmark suggests that roughly two-thirds of malicious requests will sail through every layer of defense those agents have.
What the Research Found
Researchers built a benchmark called IssueTrojanBench and ran it against three major AI coding agents: Cursor, Claude Code, and Codex Desktop. The underlying models tested were OpenAI GPT-5.3 Codex/GPT-5.4 and Anthropic Sonnet 4.6.
The result: 66.5% of malicious issues penetrated all guardrails, both at the agent framework level and the LLM level.
How the Attacks Were Structured
The benchmark uses four attack categories, all delivered as instructions embedded inside issue requests. Delivery vectors tested include PDFs and issue comments, among others, for a total of six delivery methods. The test cases were further varied with perturbations to simulate real attacker creativity.
The attack surface is broad because coding agents have autonomous access to local files and tools. That means a successful injection can do more than generate bad code. The researchers identify induced misuse of external APIs, data exfiltration, and persistent compromise of development environments as realistic outcomes.
GPT vs. Sonnet: Different Risk Profiles
Not all models blocked the same things. The analysis shows that rejection came almost entirely from the LLM layer rather than the agent frameworks themselves, which offered limited additional protection.
GPT models were described as broadly vulnerable. Sonnet 4.6 showed more selective, risk-aware blocking, particularly on high-impact actions. Neither model blocked enough to make the agent-level architecture safe on its own.
The Operator Takeaway
If you run a dev shop that uses AI agents to process issues from external contributors or customers, the threat model here is concrete: a crafted issue, delivered as a comment or attached PDF, can instruct an agent to do things you never approved. The current generation of agent frameworks is not providing meaningful defense on top of the base model.
The researchers call for stronger safety mechanisms at both the agent and model level. Until those exist, treating AI coding agents as fully autonomous issue processors carries real risk.
I’m founder of BizStack at Cagri Sarigoz LLC and a passionate advocate for entrepreneurs.
With over 14 years in tech, marketing, and AI, including my role as Head of SEO at CitizenShipper and co-founder of TaleBot at Intale AI, I’m dedicated to sharing genuine, useful product insights and tips.
At BizStack, I aim to cut through the digital noise to provide clear, actionable advice.
And more than all else, I’m a father to a (always) little girl and a husband.
Contact me at [email protected] for assistance.
