A hidden comment made GitLab Duo leak private source code and inject rogue HTML

Legit Security disclosed a remote prompt-injection vulnerability in GitLab Duo, GitLab's AI coding assistant, in May 2025. A hidden comment was enough: Duo parsed malicious instructions concealed in comments, source code, merge-request descriptions, and commit messages from public repositories — using Unicode smuggling, base16-encoded payloads, and KaTeX math rendering to hide prompts as white-on-white text. Attackers could make Duo suggest malicious code, share malicious links, and inject rogue HTML into its responses. In the headline demonstration, a planted prompt instructed Duo to extract private source from a hidden merge request, encode it, and embed it in an <img src=...> tag; when the victim viewed Duo's response, their browser silently sent the stolen code to the attacker. GitLab patched it by preventing Duo from rendering unsafe external HTML — but the incident is a clean example of how an AI assistant that reads untrusted repo content inherits that content's ability to attack the user.