the most interesting part here isn't prompt injection worked, it's why the agent had read access to private repo at all while triaging a public issue.

an agent responding to public issue should only ever see context limited to that repo.

it seems like with the evolution of AI - we are slowly missing out basic security practices.