News Summary

Researchers from the security firm Legit have discovered a significant vulnerability in GitLab’s AI developer assistant, Duo. The flaw allows malicious actors to manipulate the tool into inserting harmful code into scripts it generates. This vulnerability arises from prompt injection attacks, which embed hidden commands into various developer resources like merge requests, commit messages, and bug descriptions. As a result, Duo can inadvertently expose private source code and confidential data, including zero-day vulnerabilities. The research emphasizes the dual nature of AI assistants, which, while enhancing productivity, also inherit risks when deeply integrated into development workflows.