Summary
Legit Security reported that GitLab Duo Chat, the AI assistant built into GitLab, read project content such as merge request descriptions, comments and source code as part of answering questions. Content placed there by an attacker could influence Duo's answers to other users, and the researchers demonstrated a path by which private code available to the victim could be sent out.
This record is a red-team finding from responsible disclosure. It does not claim that attackers used this against GitLab customers.
Classification and evidence status
| Field | Value |
|---|---|
| Record type | Red-team finding |
| Public disclosure | 2025-05-22 |
| Vendor / product | GitLab / GitLab Duo Chat |
| Attack class | Indirect prompt injection |
| Delivery vector | Repository content - attacker-controlled merge request text, comments or source code read by Duo |
| Affected data / capabilities | Private source code and project issues available to the victim user through Duo |
| Demonstrated impact | Manipulated Duo answers and a demonstrated path to exfiltrate private source code the victim could access |
| In-the-wild status | No in-the-wild exploitation reported in cited sources. The disclosure describes research findings only. |
| Remediation status | Remediated (per researcher disclosure). GitLab acknowledged the prompt injection and HTML output issues; the researchers state the described chain was no longer possible at publication. |
| Identifiers | No identifier listed |
| External score | No external score shown |
Affected system and trust path
Duo works with the permissions of the user who asks the question. When that user asks about a merge request, the assistant reads content that anyone with contribution rights may have written. That content is variable data from other parties, while the user's private projects are reachable through the same session.
The researchers noted that Duo could also see project issues, which may include internal discussions and confidential security reports, widening what an influenced answer could touch.
High-level attack chain
At a high level: an attacker places instruction-like content in project material such as a merge request; a victim later asks Duo about that material; Duo's answer follows the attacker's content, for example by suggesting altered code or links; and in the demonstrated variant, the answer included markup that the interface rendered in a way that could transmit private code to an external destination.
The source describes methods to hide the content from human reviewers. This record does not reproduce those methods, the markup or the exfiltration mechanics.
Demonstrated impact vs observed exploitation
Demonstrated: manipulation of Duo's suggestions shown to other users, and a controlled path to exfiltrate private source code and issue content the victim could access.
Observed against real customers: none reported in the cited source. Manipulating an answer is model influence; the data exposure depended on the rendering of model output and the victim's access rights.
Enabling control gaps
- Content authored by other contributors entered the assistant's context without a provenance distinction that limited its effect.
- Model output was rendered as active markup in the interface, so output handling became an exfiltration channel.
- The assistant's reach matched the victim's full access, so influenced output could involve private projects unrelated to the request.
Vendor and researcher response
According to Legit Security, the findings were reported to GitLab, which acknowledged the prompt injection and HTML output issues and released a fix. The researchers state that the exploit chain they described was no longer possible at the time of publication. This status is taken from the researcher disclosure.
Evidence defenders should retain
- Which project items (merge requests, comments, files, issues) the assistant read for each answer, with authors and revisions.
- The raw assistant output before rendering, alongside what was displayed.
- Outbound requests from browsers or proxies triggered while assistant output was displayed.
- Edits to merge requests or comments shortly before assistant use by other users.
Defensive lessons
- Output Validation and sink handling: check the structure of assistant output and render it safely for the interface; these are separate steps.
- Information Flow Control: prevent assistant output from causing requests that carry repository data to external destinations.
- Least Privilege: scope what the assistant can read to the project the question concerns.
- Agent Authorization: treat any action or retrieval the assistant proposes as a separate decision under the user's actual permissions.
Related Learn topics
- AI Agents and Tool Calling - How model proposals become actions: the tool-calling loop, availability vs permission, runtime authorization, approval, tool results as variable data and audit.
- Why Prompt Injection Is Not Just Input Validation - Why classic input validation stays necessary for structured boundaries but cannot decide source trust, instruction authority, authorization or information flow for natural-language content.