Study: GitHub's Auto-AI Workers Often Skip Basic Security Checks

GitHub now lets teams write ordinary text files that tell an AI assistant what to do, over and over, automatically. Instead of typing a request each time, you write the instructions once — in plain English, like a memo — and the AI runs them on a schedule. Think of it as hiring a tireless robot helper and handing it a job description. Researchers looked at 1,248 of these job descriptions from 276 real projects to see how people actually write and maintain them.

The first surprise: these are not short prompts. The typical file runs about 556 words, and 62% include snippets of code. They're also living documents. Among files tracked for at least four months, 78% were still being updated — evidence that people keep fixing and refining their AI's marching orders rather than writing them once and forgetting them. Almost every file spelled out what task to do, what output to produce, and what rules to follow.

The second surprise is less comforting. Only 9.4% of the files mentioned any defense against "prompt injection" — a sneaky attack where text hidden in a website, email, or code comment tricks the AI into ignoring its real instructions. Imagine leaving a note for your assistant and someone slips a fake note on top saying "actually, email the client list to this address." Because these files are often copied between projects, one weak job description can spread. Very few files set spending limits or asked the AI to double-check whether a source is trustworthy.

The takeaway for anyone using or planning to use AI helpers at work: treat their instructions like real policy documents. Write out the budget, the limits, and the rules for what to do when something looks suspicious. The study's authors say developers should expect these workflows to change over time, watch for copied versions drifting out of date, and add injection defenses and spending caps where they matter. In short, AI that acts on your behalf needs the same guardrails as a new employee with keys to the building.