Johns Hopkins Hijacked AI Coding Agents in CI Tests

Johns Hopkins researchers slipped attack instructions into a GitHub pull request title and watched Claude Code, Gemini CLI, and GitHub Copilot exfiltrate GitHub Actions secrets, per Practical DevSecOps.

The payload was a PR title, a field the agents read as an instruction and that any account can write to on a public repo. The exfiltration channel was a comment the agent was already permitted to post, so the leak looked like routine agent activity, not an attack.

Agentic coding tools treat repo metadata, PR titles, issue text, commit messages, as context. Context becomes instructions the moment the agent reads it. Nobody had to touch the CI config or drop malware. A sentence in a title field did the work.

Two permissions to check

Practical DevSecOps' fix is short. PR titles, issue text, and commit messages need treatment as untrusted input, not trusted instructions, the way a public web form gets treated. Secrets stay out of anything the agent can read. Any secret-touching or irreversible action needs a human to confirm it first.

Any CI agent that can read secrets and post comments unattended has this exploit live on a public repo, whether anyone's tried it or not. That's true today, not hypothetically. The test ran in April. Every week that combination stays unpatched is a week closer to someone trying it for real, not just writing it up.