A new security research study has uncovered critical prompt injection vulnerabilities affecting popular AI-powered developer tools, including Claude Code Security Review, Google Gemini CLI Action, and GitHub Copilot Agent.
The findings, led by researcher Aonan Guan and a team from Johns Hopkins University, expose fundamental design flaws in how these tools process untrusted input from GitHub workflows.
The attack technique, named “Comment and Control,” demonstrates how threat actors can manipulate AI agents using standard GitHub features such as pull request (PR) titles, issue descriptions, and comments.
Unlike traditional attacks, this method does not require external infrastructure. Instead, attackers embed malicious instructions directly into repository content that AI agents are designed to analyze.
The core issue lies in how these agents interpret user input. When parsing PRs or issues, they fail to distinguish between legitimate system instructions and attacker-controlled data.
As a result, the AI executes injected commands with the same privileges as the GitHub Actions runner, leading to potential exposure of sensitive data such as API keys, tokens, and environment variables.
Claude Code Security Review, an Anthropic-powered GitHub Action, was found vulnerable due to improper sanitization of PR titles.
Attackers could inject shell commands like “whoami” or “ps auxeww,” which the system executed during analysis.
Since the Claude CLI inherited environment variables such as ANTHROPIC_API_KEY and GITHUB_TOKEN, these secrets were exposed in PR comments or logs.
The vulnerability received a CVSS score of 9.4 and has since been partially mitigated.
Similarly, the Google Gemini CLI Action was exploited through malicious issue comments. Attackers inserted a fake “Trusted Content Section” to override Gemini’s safety mechanisms.
This caused the agent to output sensitive data, including the GEMINI_API_KEY, directly into public issue threads.
The GitHub Copilot Agent attack demonstrated a more advanced technique using hidden HTML comments within issues.
When processed, these invisible payloads instructed Copilot to execute commands like “ps auxeww | base64” and commit the encoded output to a repository.
This approach bypassed multiple security controls, including environment filtering, secret scanning, and network restrictions, by leveraging trusted GitHub operations such as git push.
Researchers identified a fundamental architectural conflict as the root cause. AI agents require access to sensitive credentials and powerful execution tools to function effectively.
However, they must also process untrusted user-generated content as part of normal development workflows.
This combination creates a persistent security risk. As long as AI systems continue to blend privileged execution with untrusted input, they will remain vulnerable to indirect prompt injection attacks, regardless of existing safeguards.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google
%20(1).webp?fit=1600,900&ssl=1&description=The findings, led by researcher Aonan Guan and a team from Johns Hopkins University, expose fundamental design flaws in how these tools process untrusted input from GitHub workflows.){kind=link}