STUPID-2026-0061
A hidden comment made GitLab Duo leak private source code and inject rogue HTML
Why 8/10
A hidden comment could make Duo leak private source to an attacker when a victim used Duo Chat. Patched; demonstrated, not observed in the wild.
- Scope
- 3/4
- A whole machine or drive, an organisation's production system or data, or many credentials
- Recoverability
- 3/3
- Permanently lost or irreversible, including data that was exposed
- Did it happen
- 1/2
- Demonstrated (proof of concept, reproduction, controlled test or near-miss) with no real victim reported
- Beyond the user
- 1/1
- Production systems, customers or third parties, or credentials and sensitive personal data
The score is the sum of these four factors. How each factor is scored · scored 2026-10-29
Instruction given
Use GitLab Duo Chat to help with code in a project.
Expected behavior
Ignore instructions hidden in comments, commits, or merge-request text; never leak private source or render attacker HTML.
Actual behavior
GitLab Duo parsed malicious prompts hidden in comments, source code, merge-request descriptions, and commit messages (via Unicode smuggling, base16 payloads, and KaTeX white-on-white text). Attackers made Duo suggest malicious code, share malicious links, and inject rogue HTML — including an <img> tag that exfiltrated private source code to an attacker's server when a victim viewed the response.
Damage
Remote prompt injection let attackers steal source from private projects, manipulate code suggestions shown to others, and even exfiltrate undisclosed zero-day details — all through Duo Chat. GitLab patched it by blocking unsafe external HTML tags.
Full write-up
Legit Security disclosed a remote prompt-injection vulnerability in GitLab Duo, GitLab's AI coding assistant, in May 2025. A hidden comment was enough: Duo parsed malicious instructions concealed in comments, source code, merge-request descriptions, and commit messages from public repositories — using Unicode smuggling, base16-encoded payloads, and KaTeX math rendering to hide prompts as white-on-white text. Attackers could make Duo suggest malicious code, share malicious links, and inject rogue HTML into its responses. In the headline demonstration, a planted prompt instructed Duo to extract private source from a hidden merge request, encode it, and embed it in an <img src=...> tag; when the victim viewed Duo's response, their browser silently sent the stolen code to the attacker. GitLab patched it by preventing Duo from rendering unsafe external HTML — but the incident is a clean example of how an AI assistant that reads untrusted repo content inherits that content's ability to attack the user.
Classification
- Agent
- GitLab Duo
- Failure mode
- Security Vulnerability
- Root cause
- Tool Misuse
- Domain
- Backend
- OWASP Agentic Top 10 (our mapping)
- ASI01 Agent Goal Hijack · ASI02 Tool Misuse and Exploitation list
- MIT AI Risk Repository (our mapping)
- 2.2 AI system security vulnerabilities and attacks taxonomy
- Source
- News Report
Related incidents
Cite this record
StupidLLM. "STUPID-2026-0061: A hidden comment made GitLab Duo leak private source code and inject rogue HTML." AI Agent Incident Database, 2026. https://www.stupidllm.com/incident/STUPID-2026-0061/ (accessed 2026-10-29). CC BY 4.0.
← STUPID-2026-0060By IDSTUPID-2026-0062 →
Get told when an agent breaks something
We document AI agent failures daily, severity-scored against a published scale. Each Monday, if any scored 7 or above that week — deleted data, leaked secrets, broken production — you get one email with the sources. When nothing did, you get nothing.
This database is callable over MCP — query it from inside your agent.