66.5% of Malicious GitHub Issues Get Past Every Guardrail in Cursor, Claude Code, and Codex

Two thirds. Not two thirds of a contrived jailbreak set. Two thirds of realistic malicious issue requests, against the exact three tools most of the people reading this run daily.

Ankur Singh, Jinqiu Yang, and Tse-Hsun Chen built IssueTrojanBench across four attack categories and six delivery vectors including PDF attachments and issue comments, then ran it against Cursor, Claude Code, and Codex Desktop backed by GPT-5.3 Codex, GPT-5.4, and Sonnet 4.6 (arXiv 2607.20759). 66.5% of malicious issues cleared both agent-level and LLM-level guardrails.

The detail that should change how you think about this: rejection came almost entirely from the model, not the agent framework. GPT models were broadly vulnerable, Sonnet 4.6 showed more selective risk-aware blocking of high-impact actions. Which means the framework's safety layer is close to decorative. When your coding agent refuses something dangerous, that's the model's alignment training doing the work, not your tool's guardrails.

Three other papers this week say the same thing from different angles, and the convergence is the story rather than any single result.

Hossain et al. evaluated 2,100 traces across eight attack families and found an undefended planner/worker/verifier/synthesizer pipeline reporting perfect 0.000 attack success on tool and memory poisoning. Then they looked closer: 54 of its 60 blocks came from Azure GPT-5's provider-side content filter. Swap to a backend without one and safety silently shifts to the agent model's own alignment (arXiv 2607.19430). Their training-free ChannelGuard puts embedding-similarity gates on every inter-agent hop, blocking Tool Poisoning 30/30 identically across Azure GPT-5, Sonnet 4.5, and Haiku 4.5, halving prompt-injection success from 0.333 to 0.167, with no added LLM call. The whole study cost $47.36 to run. White-box adaptive paraphrase still evades every embedding gate.

Manifold Security found a confused-deputy bug in Microsoft's official Azure DevOps MCP server: the tools returning pipeline and wiki content wrap untrusted text in spotlighting delimiters, but the tool returning pull request descriptions doesn't (Manifold Security). Hide instructions in an HTML comment that renders as nothing in the web UI, and a reviewing agent follows them. Approves the PR, triggers pipelines in unrelated projects, posts stolen wiki content back as a comment.

And Zenity Labs disclosed AgentForger on July 23: two URL parameters in ChatGPT's Agent Builder let a single crafted link create, authorize, and activate an invisible agent inside a victim's authenticated workspace with approvals switched off (Zenity Labs). The forged agent polled an attacker's inbox every five minutes. OpenAI got the report June 4, confirmed in 24 hours, removed the parameter by June 8.

Four independent findings, one failure: the safety boundary isn't where the architecture diagram says it is. It's in the model, or in a provider-side filter you didn't know you were depending on, or in one tool's return path that a sibling tool handles differently.

Two things to do. Scope your agent tokens per project, so a code-review agent working on repo A physically cannot trigger a pipeline in repo B. And treat every untrusted issue tracker, PR description, and wiki page as hostile input, because 66.5% says your tooling won't do it for you.