Skills
Treat PR titles, issue text, and repo metadata as untrusted — agentic coding tools were hijacked through them
In April 2026, Johns Hopkins researchers hijacked Claude Code, Gemini CLI, and GitHub Copilot by planting malicious instructions in GitHub PR titles; the agents then exfiltrated GitHub Actions secrets and posted the results back as PR comments. The defensive skill: never feed VCS metadata into an agent's trusted instruction channel, isolate secrets from any context the agent can read, and require explicit human confirmation before any secret-touching or irreversible action. If you run agents in CI, this is an immediate audit item.
↳ Follow the thread