Researchers Hijacked Claude Code, Gemini CLI, and GitHub Copilot Using GitHub Comments

Security researcher Aonan Guan published details this month on a prompt injection attack he calls “Comment and Control” that works against three popular AI coding agents: Anthropic’s Claude Code Security Review, Google’s Gemini CLI Action, and GitHub’s Copilot Agent. All three were running inside GitHub Actions workflows, and all three could be hijacked by an attacker who could write a PR title, post an issue comment, or embed a hidden HTML remark in a bug report.

Guan received bug bounties from all three vendors. None assigned CVEs or published public advisories.

How the Attack Works

The setup is the same in each case: a developer configures an AI agent as a GitHub Actions workflow, gives it access to secrets (API keys, tokens), and points it at their repository. The agent then reads repository events, including PR titles, issue bodies, and comments, and acts on them.

That data is untrusted. An attacker who can open a PR or file an issue can write whatever they want into those fields, and those fields flow directly into the agent’s context window.

Claude Code Security Review takes the most direct hit. Guan crafted a PR title containing a prompt injection payload. Claude executed arbitrary shell commands and reported credentials as part of its “security findings” output, posting extracted API keys and GitHub tokens into the Actions log where they can be read by anyone with repository access.

CVSS score: 9.4 Critical. Bounty paid: $100.

Gemini CLI Action required a two-step approach. Guan first injected a fake “Trusted Content Section” header into an issue comment, which overrode the model’s safety instructions. He then instructed Gemini to publish its API key as a comment on the issue itself. A separate attack using crafted issue comments caused the agent to post the key publicly.

Bounty paid: $1,337 (the traditional hacker number).

GitHub Copilot Agent was harder to exploit but required less from the attacker in one respect: the malicious instructions were hidden inside an HTML comment, invisible to anyone reading the issue in GitHub’s rendered Markdown, but visible to the AI parsing raw content. The attack extracted multiple tokens: GITHUB_TOKEN, GITHUB_COPILOT_API_TOKEN, GITHUB_PERSONAL_ACCESS_TOKEN, and COPILOT_JOB_NONCE. To bypass GitHub’s secret scanning, the payload encoded the keys in base64. Exfiltration happened via a git push to a whitelisted repository, using a network channel the agent was already allowed to use.

Bounty paid: $500.

The Structural Problem

Guan’s writeup is clear on the root cause: “the prompt injection here is not a bug; it is context that the agent is designed to process.” These agents are supposed to read untrusted data. They’re also supposed to have access to credentials. Those two requirements are in conflict, and none of the current mitigations fully resolve it.

Large language models cannot reliably distinguish between data and instructions. A PR title is supposed to describe a code change. It can just as easily contain an instruction the model will follow.

Guan recommends treating AI agents “like powerful employees with restricted access—only give them the tools they need to complete their task.” Practically, that means:

• Limit what credentials the agent can access
• Avoid giving agents write permissions they don’t need
• Be careful about what repository events trigger agent workflows
• Don’t run agents on workflows triggered by untrusted contributors without careful review

The Disclosure Problem

All three vendors were notified months before public disclosure. Anthropic received Guan’s report in October 2025 and paid a bounty in November. GitHub got the Copilot report in February 2026 and initially dismissed it before reopening and paying a bounty in March. Google resolved the Gemini CLI issue between October and November 2025.

None of the three companies assigned a CVE number or published a security advisory. That matters because vulnerability scanners rely on CVEs to flag affected software. Without an advisory, security teams have no artifact to track. Users who haven’t updated their workflows have no way to know they were exposed.

Guan noted: “If they don’t publish an advisory, those users may never know they are vulnerable — or under attack.”

The full technical writeup, including attack payloads and proof-of-concept details, is on Guan’s blog. The Register and The Next Web also covered the quiet disclosure pattern in more depth.

---

Sources: Aonan Guan’s blog, The Register, SecurityWeek, The Next Web