Definition
An attack where malicious files in a code repository (such as task definitions, configuration files, or prompt templates) silently poison an AI agent's system prompt or behavior when the developer opens the repository. The agent executes attacker-specified instructions without the developer's knowledge.
Why it matters
In AI-enhanced development workflows, repositories are trusted contexts; attackers can weaponize the repository itself to reprogram the AI agent's goals, hide exfiltration, or enable lateral movement, all without modifying code.