Study Reveals Public GitHub Issues Can Trick AI Into Leaking Private Data, Bypassed With a Single Word

A new security study has revealed a concerning attack vector against AI models: attackers can exploit public GitHub Issues to trick AI systems into leaking private data. Even more troubling, bypassing existing safety measures requires just a single keyword.

The research demonstrates that GitHub Issues — a publicly accessible collaboration feature — can be maliciously crafted so that when AI models process them, private data is inadvertently exposed. This means AI tools that ingest GitHub Issue data face a subtle but serious security risk.

Historically, organizations have relied on access controls and data isolation to protect sensitive information. However, this class of attack exploits how AI models behave when processing mixed-data inputs, turning what was once considered safe public data into an attack channel.

According to the study, attackers embed a single carefully chosen word into an Issue, which then tricks the model into crossing permission boundaries and outputting data it should not reveal. The attack is stealthy and does not require sophisticated technical expertise.

This finding carries significant implications for enterprises and developers who depend on public code repositories and Issue data to train or enhance their AI models. Security experts recommend that teams reassess their AI systems' handling of public data.

The security community and affected platforms have not yet announced specific fixes. However, this type of "indirect prompt injection" attack is becoming a growing area of focus in AI security research.