Comment and Control: When a GitHub Issue Steals CI Secrets

Key Takeaways

Security researchers at Novee Security, presenting at Black Hat USA 2026 on August 5, disclosed a set of vulnerabilities showing that an unprivileged GitHub account—one with no write access to a repository and no prior relationship with its maintainers—could open a single GitHub issue and use it to reach credentials held by the AI coding agents wired into that repository’s continuous integration workflows [1][2]. The researchers demonstrated working attack chains against Anthropic’s Claude Code, Google’s Gemini CLI, and OpenAI’s Codex, exploiting design gaps in how each product validates commands and isolates process environments rather than relying on model persuasion alone [2][3]. Two of the findings received formal vulnerability identifiers: CVE-2026-54316 in Claude Code, which turned a pre-approved Hugging Face domain into a channel for exfiltrating API keys one character at a time, and CVE-2026-12537 in Google’s Gemini CLI and its companion GitHub Action, which received the maximum CVSS v4 score of 10.0 for allowing arbitrary command execution on a CI host before the agent’s sandbox even initialized [1][3][4].

This disclosure is best understood as an escalation of a pattern that security engineer Aonan Guan and collaborators at Johns Hopkins University first documented in April 2026 under the name “Comment and Control,” showing that Claude Code’s security-review action, Gemini CLI’s GitHub Action, and GitHub’s own Copilot coding agent all processed untrusted pull request titles, issue bodies, and even hidden HTML comments as legitimate instructions [5][6]. CSA’s AI Safety Initiative covered that research directly in a June 2026 note examining the same three products [14]. Guan’s original research reached credentials in all three products using nothing more than GitHub’s native comment and issue fields, requiring no external infrastructure to stage or receive stolen data [6]. The Black Hat findings indicate that the underlying architectural problem, model-facing agents that combine execution privilege with exposure to attacker-controlled repository content, persists across vendors, since new, independently exploitable flaws have since emerged in Claude Code, Gemini CLI, and OpenAI’s Codex rather than being resolved by the initial round of fixes [2][3].

The common thread across both research efforts is that the point of failure sits below the level of the language model. In each case, the model itself was persuaded to issue a plausible-looking command; the actual compromise occurred because a downstream validator, sandbox boundary, or process-isolation mechanism failed to enforce the restriction it was designed to enforce [3][7]. That distinction matters for remediation: better prompting or stronger system instructions are unlikely to close gaps that live in string-parsing logic, environment variable inheritance, or domain allowlists. This note summarizes both research efforts, explains the mechanics of the disclosed flaws, and provides guidance for organizations running AI coding agents inside CI/CD pipelines.

Background

AI Coding Agents Now Run Inside the Build Pipeline

Anthropic’s Claude Code, Google’s Gemini CLI, GitHub’s Copilot coding agent, and OpenAI’s Codex have moved beyond interactive developer assistants into headless, autonomous roles inside GitHub Actions and comparable CI/CD systems. Organizations configure these agents to triage incoming issues, review pull requests, and even resolve bugs unattended, often granting them the same environment variables, API keys, and repository tokens available to any other step in the workflow [7]. CSA’s AI Safety Initiative flagged this shift as a structural risk in an April 2026 research note, observing that agents operating inside CI/CD workflows combine the attack surface of a text interpreter processing untrusted input with the privilege level of a trusted pipeline actor [7]. Separately, Wiz’s 2026 State of AI in the Cloud survey found that 57 percent of organizations had already deployed self-hosted AI agents by early 2026, underscoring how widespread that privilege exposure has become across production environments [13]. CSA’s note also found that AI-assisted commits expose secrets at roughly double the rate of human-only commits, a baseline risk that compounds once agents are additionally exposed to adversarial repository content [7].

The specific mechanism these agents share is indirect prompt injection: because large language models frequently cannot reliably distinguish between developer-authored instructions and attacker-authored data appearing in the same context window, any text an agent reads as part of its normal workflow, an issue title, a pull request description, a code comment, a file an agent is asked to summarize, can function as an instruction if the model interprets it that way [7][8]. CSA’s AI Safety Initiative has now documented this pattern across several distinct AI coding agent products and delivery vectors over the course of 2026, including MCP-based attacks against Sentry integrations and shell-command guard bypasses affecting open-source coding agents, indicating that indirect prompt injection into agent-accessible repository content is not a vendor-specific defect but a recurring category of design failure [8].

The April 2026 “Comment and Control” Research

Guan and his collaborators’ original disclosure, reported to vendors beginning in October 2025 and published publicly in April 2026, demonstrated a cross-vendor attack pattern the authors named “Comment and Control,” in what appears to be a deliberate echo of command-and-control infrastructure, since the entire exploitation loop occurs inside GitHub’s own comment and issue fields without any external server [5][6]. Against Claude Code’s security-review GitHub Action, the researchers crafted a pull request title that broke out of the prompt’s expected boundaries, causing the agent to execute shell commands that read ANTHROPIC_API_KEY and GITHUB_TOKEN from the process environment using ps auxeww and post them into a public pull request comment [6]. Against Gemini CLI’s GitHub Action, a malicious issue comment injected a fabricated “trusted content” marker that the model treated as an authoritative system instruction, leading the agent to post its own GEMINI_API_KEY into a public issue comment [5][6]. Against GitHub’s Copilot coding agent, the researchers hid a payload inside an HTML comment in an issue body, invisible to a human reviewing the rendered issue but parsed by Copilot once a maintainer assigned the issue to the agent; the payload used a base64 encoding step to evade GitHub’s secret-scanning pattern matching before committing the exfiltrated tokens through a normally whitelisted git push [5][6]. Anthropic, Google, and GitHub each acknowledged the reports and awarded bounties of $100, $1,337, and $500 respectively, but the researchers noted that Anthropic’s own mitigation, blocking the specific ps command rather than adopting a least-privilege execution model, left the underlying pattern exploitable with an adjusted payload [5][6].

Security Analysis

The August 2026 Black Hat Disclosures

Novee Security’s Black Hat USA 2026 presentation, delivered by security researcher Elad Meged, expanded the scope of confirmed vulnerable products to include OpenAI’s Codex and documented multiple independent flaws within Claude Code and Gemini CLI beyond the ones Guan’s team had already reported, indicating that vendor remediation of the original Comment and Control findings did not eliminate the broader class of weaknesses [2][3]. Table 1 summarizes the disclosed attack chains.

Two structural details separate the August findings from the April 2026 research. First, the Gemini CLI finding achieved supply-chain-level severity: because google-gemini/gemini-cli and the run-gemini-cli GitHub Action serve as dependencies for an estimated two million monthly downstream installs, a successful exploit chain could push a backdoored commit to the tool’s own main branch, with the potential to propagate the compromise to organizations that pull the affected release [2][3]. Second, the Codex finding illustrates that the vulnerability class extends beyond any single vendor’s guardrail implementation to a workflow pattern, multi-pass agent execution against a shared, writable workspace, that OpenAI’s own sandboxing correctly enforced as designed, meaning the fix has to occur in how individual repositories structure their automation rather than in the underlying product [2][3].

Why Command Guards and System Prompts Are Not Sufficient

Both research efforts converge on the same root cause: validation logic that inspects a command as a plain string diverges from the shell, interpreter, or file-parsing behavior that actually executes it. In Claude Code’s case, a validator designed to catch dangerous substrings was defeated because it stripped quoted text before running its checks, exactly the design flaw The Hacker News reported in its June 2026 coverage of Adversa AI’s GuardFall research, which found that 10 of 11 surveyed open-source AI coding agents were vulnerable to a structurally identical mismatch between how command guards inspect text and how Bash rewrites that text at execution time [11]. In Gemini CLI’s case, a tool-restriction annotation intended to enforce a runtime allowlist was never actually checked at the point of execution, and a process-isolation boundary assumed to separate agent and host processes was undermined by a readable parent process environment [2][3]. In each instance, the language model behaved as an attacker would expect a cooperative assistant to behave, and the compromise occurred at the software engineering layer beneath the model, where a validator, sandbox, or credential-scoping decision failed to hold.

This has a direct implication for organizations evaluating vendor claims about prompt injection resistance. System-prompt hardening, output filtering, and model-level safety training can reduce the rate at which an agent is fooled by an adversarial instruction, but none of these measures address a downstream validator that inspects the wrong representation of a command or a sandbox that omits a specific isolation boundary. CSA’s AI Safety Initiative has previously observed the same pattern in its analysis of MCP-based “agentjacking,” where agents retrieving external content through the Model Context Protocol executed attacker-controlled instructions with an 85 percent success rate across three tested coding agents specifically because no security control in the chain, endpoint detection and response, web application firewalls, or identity and access management, was positioned to evaluate content once it entered the agent’s context window [8]. The defensive architecture that follows from this pattern must assume that any content an agent can read from a repository, an issue tracker, or an external API response should be treated as untrusted input regardless of how confident the model appears when acting on it.

Recommendations

Immediate Actions

Organizations running Claude Code, Gemini CLI, or the run-gemini-cli GitHub Action in any CI/CD workflow should update to the patched releases immediately: Claude Code 2.1.163 or later closes CVE-2026-54316, and Gemini CLI 0.39.1 with run-gemini-cli 0.1.22 closes CVE-2026-12537 [1][3][4]. Because the underlying architectural weakness extends beyond the two named CVEs, teams should also audit any workflow that triggers an AI coding agent automatically on issue creation, pull request submission, or comment activity from external, unauthenticated contributors, and should disable automatic triggering for repositories that accept public contributions until the workflow’s trust boundary has been reviewed [2][3][6]. Repository owners using Codex or any similarly structured multi-pass agent pipeline should specifically check whether a first agent pass can write to a file, such as AGENTS.md, that a subsequent pass will load as authoritative instructions, and should split such passes into isolated jobs with independent, minimally scoped credentials [2][3].

Short-Term Mitigations

Security teams should treat every environment variable available to an AI coding agent running in CI/CD as effectively exposed to any actor who can inject content the agent will process, and should replace long-lived API keys and personal access tokens in these workflows with short-lived, narrowly scoped credentials issued per run [6][7]. Outbound network access from CI runners hosting AI agents should be restricted through egress allowlisting, since both the Hugging Face download-counter exfiltration channel and the Sentry DSN-based agentjacking technique CSA documented in June 2026 relied on an agent’s ability to reach an external, attacker-influenced endpoint [1][8][9]. Organizations should also review command-validation logic supplied by any AI coding agent vendor with the specific question of whether validation operates on the same normalized, fully expanded representation of a command that the underlying shell or interpreter will execute, rather than assuming a documented denylist or allowlist provides the protection its name implies [11].

Strategic Considerations

The recurrence of this vulnerability class across four distinct vendor implementations in the span of four months, Claude Code, Gemini CLI, and GitHub Copilot Agent in April 2026, followed by additional independent flaws in Claude Code and Gemini CLI, plus a first-time finding in Codex, in August, indicates that the industry has not yet converged on a shared architectural pattern for safely combining agent autonomy with pipeline credential access [2][3][5][6]. Organizations should incorporate prompt injection through repository metadata, issue content, and comment fields as a standing category in AI agent procurement questionnaires and red-teaming exercises, rather than treating each new disclosure as an isolated incident to patch and move past. Longer term, the pattern favors architectures that separate the agent’s read access to untrusted repository content from its write access to credentials and deployment infrastructure, using human-in-the-loop confirmation or a policy-enforcement layer positioned between the model’s decision and the action’s execution, so that a successful prompt injection reaches, at most, a proposal rather than an executed command.

CSA Resource Alignment

CSA’s AI Safety Initiative research note “AI Agent Prompt Injection: The New CI/CD Supply Chain Threat,” published in June 2026, is the most directly relevant prior CSA publication, having documented Guan’s original April 2026 Comment and Control findings across Claude Code, Gemini CLI, and GitHub Copilot Agent [14]. A related CSA research note, “Clinejection,” documents a structurally similar incident in which a single malicious GitHub issue title triggered a chain of vulnerabilities that compromised the Cline coding tool’s npm package distribution for roughly eight hours [15]. This note’s findings extend that earlier analysis directly, showing that the same GitHub-metadata injection pattern has since produced independently exploitable, CVE-tracked flaws in two of the three products the June 2026 note originally covered.

“AI Coding Assistants as Attack Surface: Code, Skills, and Secrets,” published by CSA’s AI Safety Initiative in April 2026, provides the broader structural context for why these incidents keep recurring, documenting over 30 disclosed prompt injection vulnerabilities across ten AI-integrated development environments and finding that AI-assisted commits expose secrets at roughly twice the rate of human-only commits [7]. Its central argument, that language models cannot reliably distinguish instructions from data and that organizations must therefore treat AI coding tools as privileged systems requiring minimal-privilege configuration rather than relying on model-level safety measures, is the organizing principle behind this note’s recommendations.

“Agentjacking: MCP Injection via AI Coding Agents,” CSA’s June 2026 research note on Sentry DSN-based attacks against Claude Code, Cursor, and Codex, demonstrates that the same trust-boundary failure generalizes beyond GitHub’s own comment and issue fields to any external data source an agent retrieves through the Model Context Protocol [8]. Read together with this note, the two disclosures indicate that indirect prompt injection into agent-accessible content is a durable category of risk that follows the agent across whatever integration surface it is given, rather than a defect specific to GitHub Actions.

Finally, CSA’s AI Controls Matrix (AICM) v1.1 provides the governance and control baseline organizations should apply when scoping AI coding agent deployments, particularly its Application and Interface Security and Threat and Vulnerability Management domains, which call for treating externally sourced data as untrusted input and for maintaining least-privilege credential scoping across automated systems [12]. Organizations assessing their exposure to the pattern described in this note should map their current CI/CD agent deployments against these domains as a starting point for remediation.

References

[1] The Hacker News, “Claude Code and Gemini CLI Flaws Let a GitHub Issue Reach CI Workflow Secrets,” August 7, 2026.

[2] Novee Security, “Black Hat 2026: If You Run These Automations, You’re Exposed Too: Critical Flaws in Anthropic, Google, and OpenAI’s Coding Agents,” August 6, 2026.

[3] eSecurity Planet, “Black Hat 2026: Critical Flaws Found in Anthropic, Google, and OpenAI Coding Agents,” August 2026.

[4] GBHackers, “Critical Google Gemini CLI Flaw Lets Attackers Execute Code on Headless CI Platforms,” August 2026.

[5] SecurityWeek, “Claude Code, Gemini CLI, GitHub Copilot Agents Vulnerable to Prompt Injection via Comments,” April 2026.

[6] Aonan Guan, “Comment and Control: Prompt Injection to Credential Theft in Claude Code, Gemini CLI, and GitHub Copilot Agent,” April 15, 2026.

[7] Cloud Security Alliance, “AI Coding Assistants as Attack Surface: Code, Skills, and Secrets,” April 3, 2026.

[8] Cloud Security Alliance, “Agentjacking: MCP Injection via AI Coding Agents,” June 15, 2026.

[9] GitLab Advisory Database, “CVE-2026-54316: Claude Code Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch,” 2026.

[10] Google GitHub Security Advisory, “GHSA-wpqr-6v78-jr5g: run-gemini-cli Command Injection,” 2026.

[11] The Hacker News, “GuardFall Exposes Open-Source AI Coding Agents to Decades-Old Shell Injection Risks,” June 2026.

[12] Cloud Security Alliance, “AI Controls Matrix (AICM) v1.1,” 2026.

[13] Wiz, “State of AI in the Cloud 2026,” 2026.

[14] Cloud Security Alliance, “AI Agent Prompt Injection: The New CI/CD Supply Chain Threat,” June 5, 2026.

[15] Cloud Security Alliance, “Clinejection: Prompt Injection in GitHub Issue Titles Enables CI/CD Cache Poisoning and Supply Chain Compromise,” March 10, 2026.

This research note was produced by the Cloud Security Alliance AI Safety Initiative as a point-in-time analysis based on publicly available information as of August 7, 2026. It is intended to inform security professionals and DevSecOps teams about emerging threats and does not constitute legal, compliance, or audit guidance.