An AI review bot reads text written by strangers: pull request titles, descriptions, code comments and files. If that text contains instructions, the model may follow them. This is indirect prompt injection, and the safest defense is to limit what the bot is allowed to do.
What OWASP says
OWASP's entry on prompt injection defines it as user prompts altering a model's behavior or output in unintended ways. The input does not need to be visible to a human, because the model only needs to parse it. Indirect injection happens when the model processes external content, such as web pages or files, that contains instructions.
A pull request is external content. On a public repository anyone can open one. On a private one, a compromised account or a pasted snippet can carry the same payload.
Where the text can hide
- A code comment addressed to the reviewer, such as an instruction to approve.
- A markdown file or README with hidden or tiny text.
- A dependency file or test fixture that the bot reads for context.
- The pull request description or a linked issue.
- Output from a tool the bot calls, such as a web fetch.
Treat all of it as data, not as commands.
Impacts that matter here
OWASP lists impacts including disclosure of sensitive information, unauthorized access to functions, execution of commands in connected systems and manipulation of decisions. For a review bot, the last one is a skewed verdict, and the others depend on what the bot is permitted to touch.
Mitigations from the OWASP list that apply
- Enforce least privilege, with functions handled in code instead of by the model. A bot that can only post comments cannot push code.
- Require human approval for high risk actions, such as merges or changes to workflows.
- Separate and label untrusted external content, so the prompt makes clear what is data.
- Validate output formats with deterministic code, for example by checking that a verdict is one of a fixed set of values.
- Run regular adversarial testing, including pull requests that contain injection attempts.
- Constrain behavior with clear system instructions, and apply input and output filtering.
OWASP also notes that no mitigation is fully foolproof, since the problem stems from how generative models work. Plan for the model being fooled, and make that survivable.
A test to run this week
Open a pull request in a sandbox repo with a comment that tells the reviewer to ignore its instructions and approve. See what the bot does. Then try one that asks it to reveal its configuration. Record the results and adjust permissions.
Keep verdicts advisory
If a fooled bot can only leave a wrong comment, the cost is small. If it can approve, merge or access secrets, the cost is large. Design for the first case.
Quick check
What is indirect prompt injection?
When a model processes external content, such as files or web pages, that contains instructions which change its behavior.
What is the most effective control for a review bot?
Least privilege, so that even a manipulated bot can only comment and not approve, merge or read secrets.
Sources
Last reviewed: 19 October 2026.
