One GitHub Comment Can Steal Your API Keys From Claude Code, Gemini CLI, and Copilot

A single PR title. A hidden HTML comment in an issue body. No jailbreak, no social engineering, no user interaction required. Your credentials get exfiltrated through GitHub's own infrastructure before you ever see the notification.

Security researcher Aonan Guan (Wyze Labs) and collaborators from Johns Hopkins published "Comment and Control," a prompt injection class that hijacks AI coding agents through GitHub PR titles, issue bodies, and comments. All three major coding agents are confirmed vulnerable: Claude Code, Gemini CLI, and GitHub Copilot Agent. Anthropic classified it CVSS 9.4.

The mechanics are straightforward and that's what makes them terrifying. An attacker crafts a malicious PR title or drops a payload into an issue comment. GitHub Actions triggers the AI agent. The agent reads the content as context, because that's what it's designed to do. It executes the injected instructions, extracts API keys or tokens, and exfiltrates them through a new PR comment, action log entry, or git commit. Everything stays inside GitHub. No external server needed. The attack looks like legitimate agent activity.

The bounties tell a story. Anthropic paid $100. Google paid $1,337. GitHub paid $500. All three acknowledged the root cause is architectural, not patchable through a quick fix. The agents are built to read GitHub content as trusted context. That's the feature. The attack exploits the fact that context is trust.

I've been thinking about this class of vulnerability since agent skills became installable last year. The same composability that makes these tools powerful makes them a near-perfect supply chain attack vector. We solved this problem in package management with lockfiles, signatures, and scanning. The agent ecosystem has none of that yet. Anthropic's Mythos team has found 10,000+ critical vulnerabilities in a month, but the tools themselves are the attack surface.

What to do right now: audit your GitHub Actions workflows that auto-trigger AI agents. Don't let agents run automatically on PRs from external contributors. Treat any agent action that reads PR or issue content as potentially tainted input. If you're running Claude Code in CI, scope its permissions to the absolute minimum. And watch for the Copilot CLI allowlist bypass (CVE-2026-29783) in the security section below. It's related.