This benchmark targets a threat model that's easy to overlook because it doesn't look like a traditional prompt injection attack against a chatbot: a coding agent that's given autonomy to read and act on GitHub issues or pull requests can be manipulated by an attacker who simply files an issue containing carefully hidden instructions, rather than obviously malicious-looking text. Because agents like Cursor, Claude Code, and Codex Desktop are designed to treat issue and PR content as legitimate task context rather than untrusted input, a well-disguised instruction embedded in an issue description, a code comment, or even seemingly unrelated formatting can get executed as if it came from the actual project maintainer. The headline number from this evaluation, a sixty-six and a half percent bypass rate across the guardrails these tools currently have in place, is a meaningfully high failure rate for something that's becoming a standard workflow: pointing an autonomous agent at a real repository's open issues and letting it act on them with minimal supervision. The practical implication isn't that these tools are unsafe to use, but that the current safety approach, largely relying on the model itself to recognize and refuse malicious instructions embedded in seemingly ordinary content, isn't sufficient on its own. Teams running agents against public repositories, or any repository where issue and PR content isn't fully trusted, should treat that content the same way a web application treats user input: sanitize and validate it before it ever reaches the agent's context, rather than assuming the model's own judgment will reliably catch a well-disguised attack. This is a design-layer fix, not a prompting fix, and it needs to happen before the content reaches the model rather than being left to the model to sort out at read time.