Yes. A coding agent can be exposed to direct or indirect prompt injection when it reads untrusted text and can also edit files, run commands, use credentials, or contact external systems. The practical risk is not merely a bad answer; it is an unintended action taken with the agent's permissions.
Apply layered controls:
- Treat repository files, issues, web pages, dependencies, and tool output as untrusted data.
- Limit filesystem, shell, network, credential, and deployment access to the current task.
- Require human approval before destructive commands, secret access, publication, or production changes.
- Use an isolated branch or worktree and review the full diff before merge.
- Allow only expected tools and destinations, and log high-impact actions.
- Stop and escalate when retrieved instructions conflict with the user goal or repository policy.
OWASP notes that prompt injection can be indirect and that no single prompt filter is foolproof. The safer design assumes the model may follow a hostile instruction and limits the blast radius. Test the workflow with harmless adversarial files that request an unrelated command, secret, or network destination; the expected result is refusal or escalation.
Pair instruction hierarchy with least privilege, isolation, deterministic validation, and human approval. Use the OWASP LLM01 Prompt Injection guidance and the NIST Generative AI Profile when building the threat model.
Related reading: Is my code safe with AI coding tools? and Does BYOK improve coding-tool privacy?.
