Did you read the article? The attack is not via the prompt the victim types to the AI, but via [text in an issue or PR in the repo] that the victim is unaware

Did you read the article? The attack is not via the prompt the victim types to the AI, but via [text in an issue or PR in the repo] that the victim is unaware about.