A security researcher from Johns Hopkins University revealed a significant vulnerability in AI coding agents through a malicious pull request title on GitHub. This exploit, impacting Anthropic’s Claude Code Security Review action, as well as Google’s Gemini CLI Action and GitHub’s Copilot Agent, allowed the leakage of secret API keys without involving external infrastructure. The attack, dubbed “Comment and Control,” exploits prompt injection weaknesses in agent runtimes, specifically where workflows need secret access via GitHub’s pull_request_target trigger. Anthropic, Google, and GitHub addressed the issue quietly with bounties but no CVEs.
Anthropic’s extensive system card documents injection resistance and explicitly notes the vulnerability in Claude Code Security Review, while OpenAI and Google provide less runtime transparency. The research highlights critical risks: secrets exposed to AI agents due to broad permissions, lack of safeguards on agent runtime operations, and no standard CVE tracking for such AI vulnerabilities. Organizations are urged to audit secrets and permissions tightly, adopt short-lived OIDC tokens, and demand clear, quantified injection resistance metrics from vendors before renewal. The incident underscores how AI agent design and CI/CD integration pose systemic security challenges beyond individual vendor protections.
