Attackers could inject prompts into a GitHub issue and take over the AI agent designed to automatically triage the issue.