# Radware: 47 attacks on coding agents hidden in GitHub issues and READMEs

> Radware's GitHub-scale scan found hidden agent-directed text to be common, while outright attacks on other people's agents are rare.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Research
- **Published by:** Radware
- **Disclosed:** 2026-10-26
- **Affects:** AI coding agents, GitHub
- **Research by:** Gabi Nakibly, Zvika Babo
- **Primary source:** https://github.com/rdwr-gabin/github-ipi-in-the-wild
- **Page:** https://theinjection.dev/items/radware-github-ipi-in-the-wild/

Radware scanned 95.1 million GitHub issues and pull requests, 47.6 million archived items and 2 million top repository READMEs for instructions hidden from humans but visible to coding agents, finding 47 attack attempts.

## What happened

Radware published a GitHub-scale measurement of indirect prompt injection against coding agents on October 26, 2026, releasing the findings data, the methodology and the scanning tool under an MIT license. Gabi Nakibly and Zvika Babo of Radware ran the study. The dataset covers every public issue and pull request created from June 1 to September 30, 2026, plus archived items reaching back to September 2025.

## How it works

Hidden text, not injection phrasing, is the detection signal. Radware reports that searching for typical injection wording produced mostly false positives, so the scanner looks for text a human reader does not see but that stays in the raw Markdown an agent reads: HTML comments in issues and pull requests, and also invisible Unicode, white LaTeX and CSS-hidden elements in READMEs. A two-stage LLM classifier narrowed 34,448 flagged items to 13,141, copied issue and pull request template text was removed, and the remaining 5,251 items were reviewed by hand.

## Who is affected

Any coding agent that reads GitHub issues, pull requests, comments or READMEs sits in the exposed position, because the hidden text lives in content the agent consumes rather than in the repository's code. Radware reports hidden text in 3.4% of issues, pull requests and comments overall, and real agent-directed text in 106 of the 2 million most-starred READMEs.

## What to do

Treat GitHub issue, pull request and comment text as untrusted input to coding agents, and strip or surface HTML comments and invisible characters before an agent reads them. Radware's ipi-scan tool and its published findings can be run against your own repositories, though the repository warns that the dataset carries live attack payloads.

## Quick facts

- **Items scanned:** 95.1M issues and PRs (June to September 2026), 47.6M archived items, 2M top READMEs
- **Attack attempts:** 47 total: 43 in issues, PRs and comments, 4 in READMEs
- **Agent-directed findings:** 2,281 in issues, PRs and comments, about 16 per million items
- **Breakdown:** 1,519 first-party orchestration, 374 content override, 345 defensive, 43 attack
- **Trend:** 7.0 to 15.4 findings per million new issues and PRs, June to September 2026
- **Found by:** Gabi Nakibly and Zvika Babo (Radware)
- **Caveat:** All figures are lower bounds, because only text hidden from humans was counted

## Questions

### How common are prompt injection attacks on coding agents on GitHub?

Radware found 43 attack attempts in issues, pull requests and comments, about one in every 3.3 million items scanned, plus 4 more in READMEs. Hidden agent-directed text is far more common than attacks: 2,281 findings, or roughly 16 per million items. Radware stresses every figure is a lower bound, because only text hidden from human readers was counted.

### What are attackers trying to make coding agents do?

Radware's attack category covers hidden text that tries to make another party's agent act against that party: leaking data, running commands, forging review verdicts, approving or merging changes, or misleading the user. Most hidden text Radware found was not an attack. The largest category, 1,519 findings across 178 projects, was projects leaving instructions for their own agents.

### Is hidden agent-directed text on GitHub increasing?

Radware measured growth from 7.0 to 15.4 findings per million new issues and pull requests between June and September 2026, a 2.2-fold rise across four months. Radware also counted coordination markers spreading from 11 projects to 69 over the same period. Both trends come from its crawl of 2026 items, which Radware treats as more complete than its archived data.

## Sources

1. [Research Repository](https://github.com/rdwr-gabin/github-ipi-in-the-wild)
2. [Methodology](https://github.com/rdwr-gabin/github-ipi-in-the-wild/blob/main/docs/methodology.md)