decrypted · 20 july 2026 · ransomware and cybercrime · vulnerabilities and patching · ai and llm security

A forged GitHub comment, and the coding agents that couldn't tell the difference

Researchers this month found a way to make Claude Code, OpenAI's Codex and Google's Gemini CLI misbehave without writing a single malicious instruction: they simply lied about what a piece of data was. The technique, described in a paper from Seoul National University, the University of Illinois Urbana-Champaign and Largosoft, and reported by The Hacker News on 16 July, punctures a defence the industry had started to trust. It matters here because the same agents are now standard kit in UK development teams, and the NCSC spent May explaining exactly how carefully that adoption needs managing.

How a review became a command

Most prompt injection defences look for instructions hidden in content an agent reads: a webpage telling a browsing agent to ignore its previous instructions and transfer funds. Vendors have got reasonably good at spotting that. Agent Data Injection, or ADI, does something quieter. It attacks the metadata an agent treats as fact rather than as text: a sender's name, a button's ID, the result of an automated code check. Attackers sprinkle ordinary punctuation, quotes, brackets, line breaks, into these fields so the model misreads where one piece of structured data ends and another begins. A forged product review can reuse a real button's identifier to trigger a purchase. A forged GitHub comment can impersonate a maintainer well enough that a coding agent executes the attacker's code as if a colleague had approved it.

Across six frontier models with no defences in place, the researchers got success rates of 31 to 43 per cent against structured data such as JSON, and up to 100 per cent against web page content. More tellingly, run against defences purpose-built to catch prompt injection, the old approach of hiding instructions in text dropped to under 1 per cent, while ADI still got through up to half the time. Think of it as the difference between a forger writing a fake cheque and a forger changing the name printed on a genuine one. Banks catch the first. The second walks straight through, because the system never questioned whether the printed name deserved trust.

Secure by Design already had the answer

This isn't a new category of mistake, it's the one the NCSC flagged in May, when it and international partners in the US, Australia, Canada and New Zealand published joint guidance on adopting agentic AI: least privilege, limited scope, no long-lived credentials, secure defaults, because "if you cannot understand, monitor or contain an agent's actions, it is not ready for deployment." ADI shows exactly why that caution was warranted. An agent that cannot tell trusted control data from untrusted content is an agent that should never have been given standing access to make purchases, merge code or run commands unsupervised. OpenAI, Google and Anthropic have acknowledged the report; none has a shipped fix. Until then, control sits outside the model: validate every field against a strict allowlisted schema, strip formatting from any field the agent didn't generate, and scope agents so a compromised session can't turn into real damage.

Also this week

A Windows privilege escalation nobody can patch yet. A researcher going by Chaotic Eclipse (also known as MSNightmare) published working exploit code for a flaw in the Windows User Profile Service, dubbed LegacyHive, less than an hour after this month's Patch Tuesday. Because the service completes its access check under an impersonated SYSTEM context rather than the requesting user's, a standard user can trick it into mounting another user's registry hive, even on systems patched this month, across every supported version of Windows 10, 11 and Server. Microsoft says it's investigating; there's no CVE and no fix. For the shared desktops, jump boxes and terminal servers common across UK organisations, the interim mitigation is restricting local logon for privileged accounts and watching for unexpected registry hive activity.

Lidl customers hit by a supplier breach, not a Lidl breach. Lidl notified customers in Germany, Belgium and the Netherlands, not the UK, that a hacked IT service provider had exposed names, phone numbers, emails and dates of birth held in a separately stored file. Passwords and payment data were untouched, and Lidl says its own systems weren't breached. The lesson for UK retailers using third-party e-commerce providers is familiar: your blast radius includes every store of customer data your suppliers hold, not just your own.

A London-listed microfinance group named on a ransomware leak site. The INC Ransom group has listed ASA International, whose parent, ASA International Group plc, is a UK-registered public company on the London Stock Exchange, as a victim, and threatened to publish stolen data. Neither the company nor mainstream security outlets have confirmed the claim at the time of writing, only ransomware-tracking sites. Treat it as a claim, not a confirmed breach, until the company says otherwise.

Sources

If you're weighing how much autonomy to hand an AI agent, get in touch and we'll help you think it through.

More like this

Get the next post by email: subscribe to Decrypted. Double opt-in, unsubscribe any time, or take the RSS feed.