Comment by motorest

> That's the thing. LLM or MCP is not a database. You can’t compare it.

You can. Read the article. A malicious prompt is injected into an issue to trigger the repo owner's LLM agent to execute it with the agent's credentials.