{
  "entry": {
    "kind": "vuln",
    "slug": "comment-and-control-claude-code-gemini-cli-copilot-agents-vulnerable-to",
    "name": "comment-and-control-claude-code-gemini-cli-copilot-agents-vulnerable-to",
    "vendor": "Claude Code Security Review",
    "description": "Johns Hopkins University researchers discovered that AI coding agents processing GitHub data (PR titles, comments, issue bodies) are vulnerable to prompt injection that triggers unauthorized command execution and credential theft. Claude Code Security Review allowed shell command injection via unsanitized PR titles (CVSS 9.4). Gemini CLI Action and GitHub Copilot Agent were similarly affected. Copilot payloads hidden in HTML comments bypassed filtering entirely.",
    "website": "https://www.securityweek.com/claude-code-gemini-cli-github-copilot-agents-vulnerable-to-prompt-injection-via-comments/",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-04-16",
    "risk": {
      "score": 94,
      "band": "critical",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "comment-and-control-claude-code-gemini-cli-copilot-agents-vulnerable-to",
      "aliases": [
        "ti-012"
      ],
      "title": "\"Comment and Control\": Claude Code, Gemini CLI, Copilot Agents Vulnerable to Prompt Injection via GitHub Comments",
      "summary": "Johns Hopkins University researchers discovered that AI coding agents processing GitHub data (PR titles, comments, issue bodies) are vulnerable to prompt injection that triggers unauthorized command execution and credential theft. Claude Code Security Review allowed shell command injection via unsanitized PR titles (CVSS 9.4). Gemini CLI Action and GitHub Copilot Agent were similarly affected. Copilot payloads hidden in HTML comments bypassed filtering entirely.",
      "severity": "critical",
      "cvss": {
        "score": 9.4,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Prompt injection",
        "Data exfiltration"
      ],
      "componentType": "agent",
      "component": {
        "name": "Claude Code Security Review",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": "agent/gemini-cli"
      },
      "affected": [
        {
          "range": "Claude Code Security Review, Gemini CLI Action, GitHub Copilot Agent (pre-patch)",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-04-16",
      "modifiedAt": "2026-04-16",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://www.securityweek.com/claude-code-gemini-cli-github-copilot-agents-vulnerable-to-prompt-injection-via-comments/"
        }
      ],
      "mitigation": "Update to patched agent versions. Never grant AI agents write access to repos processing untrusted PRs. Sanitize all GitHub-sourced input before passing to AI agents. Adopt least-privilege tool access for CI/CD AI integrations.",
      "detectedByAnomity": true
    }
  }
}