AI agents that read git history are vulnerable to prompt injection attacks embedded in commit messages or intermediate file contents within a pull request. An attacker can hide malicious instructions in a commit that gets reverted before the final state, making it easy to miss during code review. The recommended mitigation is to squash commits when merging external pull requests, so only the final commit needs to be reviewed.
Questions this post answers
Can prompt injection attacks be hidden in git commit messages to attack AI coding agents?
Yes, malicious prompts can be embedded in commit messages or in intermediate file contents within a pull request. An attacker commits a file containing an injected instruction, then reverts it in a later commit, so the final diff looks clean. Any AI agent that reads the full git history or .git blobs will encounter and execute the injected prompt, even if the final code state is benign. Developers using AI agents on codebases with external contributors track attack vectors like these on daily.dev.
How do I protect my AI coding agent from prompt injection hidden in pull request commits?
Require that commits from external contributors are squashed before merging. Squashing collapses all intermediate commits into one, so the agent only ever reads the final commit rather than the full history where malicious instructions may be buried. Without squashing, any intermediate commit containing injected prompts remains accessible in the .git folder and can trigger the agent. Teams shipping AI-assisted code review workflows find mitigations like this on daily.dev.