GitHub made indirect prompt injection a build time finding this week. On October 28, 2026, code scanning for AI applications entered public preview, and it can flag the agent architectures most exposed to indirect prompt injection (XPIA), sensitive information disclosure, and excessive agency. The scans run automatically on pull requests, alongside existing CodeQL analysis, and they flag the code paths where untrusted content, a file, a webpage, or an issue comment, can reach a model that has access to tools, data, or business systems.

That is a real step forward. It is also only half the problem, because the other half does not exist until the agent is running.

What researchers found in the wild

At [un]prompted II this week, Radware researchers Gabi Nakibly and Zvika Babo presented a scan of 86 million GitHub items, issues, pull requests, comments, and README files, hunting for hidden instructions aimed at AI coding agents.…