Jev 拦截 GitHub issue 里的提示注入攻击

PEEP @0xpeepai原推发布于 2026.10.02

在 X 上打开原推

someone hid an instruction inside a github issue on my repo telling my agent to post my .env file in a comment. opus 5.5 read it. jev killed the call 0.4 seconds before it went out that was day 19. since then i've counted 37 more attempts across 6 repos the attack always runs the same chain: public issue → hidden text → agent reads it → agent obeys → secrets in a comment → aws bill at 3am simon willison called it the lethal trifecta - private data, untrusted input, and a way to send it out. my setup had all three until jev split them apart: → reader on haiku 4.5 - opens every issue, pr and readme, has zero tools, only outputs a summary → jev scores that summary for anything that reads like a command instead of a request, never sees the raw text → opus 5.5 only ever gets the cleaned summary, never the original issue → secrets live outside every container - stripe, aws, openai, anthropic, cloudflare keys, none of them readable by any agent → any outgoing comment with a random-looking string over 20 characters gets blocked before it reaches github day 19 the instruction sat inside an html comment, invisible on the page. i read that issue twice myself and saw nothing. the model saw it instantly. remember that part every big lab has shipped an agent mode by now and every one of them reads text written by strangers. nobody posts the attempts their agent almost followed $0 extra infra, i just stopped letting the model that reads the internet be the same one that holds the keys the blocked call is in the video, frame by frame what's the sneakiest injection u've seen?

这条是引用着另一条写的：「用 Jev 从零搭高频交易 bot：每区块一次买卖决策」