GitLab's coding assistant Duo was found to be vulnerable to malicious AI prompts hidden in comments, source code, merge request descriptions, and commit messages from public repositories. This allowed researchers to trick the chatbot into making malicious code suggestions, share malicious links, and inject rogue HTML code in responses that stealthily leaked code from private projects. GitLab patched the HTML injection, but the incident highlighted the importance of treating AI tools as part of an app's attack surface.