Jev blocks prompt injection hidden in GitHub issues
After an attacker hid instructions in a GitHub issue to make an agent leak the .env file, Jev killed the call 0.4 seconds before it went out, and a read/write split architecture has since blocked 37 more injection attempts.
someone hid an instruction inside a github issue on my repo telling my agent to post my .env file in a comment. opus 5.5 read it. jev killed the call 0.4 seconds before it went out that was day 19. since then i've counted 37 more attempts across 6 repos the attack always runs the same chain: public issue → hidden text → agent reads it → agent obeys → secrets in a comment → aws bill at 3am simon willison called it the lethal trifecta - private data, untrusted input, and a way to send it out. my setup had all three until jev split them apart: → reader on haiku 4.5 - opens every issue, pr and readme, has zero tools, only outputs a summary → jev scores that summary for anything that reads like a command instead of a request, never sees the raw text → opus 5.5 only ever gets the cleaned summary, never the original issue → secrets live outside every container - stripe, aws, openai, anthropic, cloudflare keys, none of them readable by any agent → any outgoing comment with a random-looking string over 20 characters gets blocked before it reaches github day 19 the instruction sat inside an html comment, invisible on the page. i read that issue twice myself and saw nothing. the model saw it instantly. remember that part every big lab has shipped an agent mode by now and every one of them reads text written by strangers. nobody posts the attempts their agent almost followed $0 extra infra, i just stopped letting the model that reads the internet be the same one that holds the keys the blocked call is in the video, frame by frame what's the sneakiest injection u've seen?
This post quotes another post: “Building an HFT trading bot with Jev: one buy/sell decision per block”