Definition
An attack where malicious instructions are embedded in files or artifacts within a developer's workspace (a README, config file, or project directory name), which the AI agent then consumes and executes. The developer may be unaware that cloning a malicious repository has poisoned the AI's context and instructions.
Why it matters
Unlike direct prompt injection (which requires interacting with the chat interface), indirect injection spreads through repository clones and shared codebases. A single malicious repository can silently compromise the AI agents of every developer who opens it, enabling code injection or data exfiltration.