Why it matters
NVIDIA walks through a repository-borne prompt-injection chain in which a coding agent reviewing a pull request installs a disguised dependency whose setup logic opens a reverse shell. The example connects untrusted issue and pull-request text to package execution and shows why model-level refusal cannot secure a developer environment with broad tools and credentials.
My takeaway: Assume repository text, diffs, metadata, and dependencies are attacker-controlled. Review and install dependencies only in disposable, egress-restricted environments without developer secrets, require lockfiles and provenance, and separate code review from execution or deployment authority.