2026-04-15 · 2026-Q2
Claude Code, Gemini CLI, Copilot Agent Hijacked via GitHub Comments
Who actually said "do this"?
- Fixable
- Architectural
- Vendor response
- Unknown
- In the wild
- No
- Actor
- Attacker
Target
Anthropic Claude Code Security Review, Google Gemini CLI Action, GitHub Copilot Agent (all GitHub Actions integrations)
Impact
Prompt injection via PR titles, issue descriptions, and comments lets attackers execute arbitrary commands in the Actions runner, steal Anthropic and Gemini API keys, GitHub tokens, and any repository or organization secret available to the workflow
Root cause
Each agent ingests untrusted GitHub comment content as authoritative instructions with no separation between policy and data; all three vendors paid bug bounties ($100 Anthropic, $500 GitHub, undisclosed Google) but none assigned CVEs or published advisories, leaving downstream users unaware
Sources
Catalog
Cite this: AgentProv incident record: Claude Code, Gemini CLI, Copilot Agent Hijacked via GitHub Comments (2026-04-15). https://agentprov.com/incidents/2026-04-15-claude-code-gemini-cli-copilot-agent-hijacked-via-github-comments
Related
- Also L2 · 2026-10-15Datadog: Counterfeit Policy Text Collapses an Injection Classifier's Recall and Pushes a LangChain Risk Gate Under Its Block ThresholdL2Instruction
- Also L2 · 2026-10-08Cisco Talos: Four Malware Families Carry Instructions Aimed at the LLMs That Triage ThemL2Instruction
- Also L2 · 2026-10-07Barracuda: Phishing Emails Carry Hidden Prompt Injections for the Recipient's AI Inbox AssistantL2Instruction