"Comment and Control": Claude Code, Gemini CLI, Copilot Agents Vulnerable to Prompt Injection via GitHub Comments
"Comment and Control": Claude Code, Gemini CLI, Copilot Agents Vulnerable to Prompt Injection via GitHub Comments is a critical-severity prompt injection issue (CVSS 9.4) in Claude Code Security Review, an AI agent. Affected: Claude Code Security Review, Gemini CLI Action, GitHub Copilot Agent (pre-patch).
Is Claude Code Security Review running on your developers' machines? Anomity finds every device with this AI agent installed, shows the version, and can block it by policy. Detect this across your developers' devices with Anomity →
Key facts
- ID
comment-and-control-claude-code-gemini-cli-copilot-agents-vulnerable-to- Severity
- critical
- CVSS score
- 9.4
- Attack type
- Prompt injection, Data exfiltration
- Component
- Gemini CLI · AI agent
- Known exploited
- No known exploitation
- Published
- Last verified
What is this vulnerability?
Johns Hopkins University researchers discovered that AI coding agents processing GitHub data (PR titles, comments, issue bodies) are vulnerable to prompt injection that triggers unauthorized command execution and credential theft. Claude Code Security Review allowed shell command injection via unsanitized PR titles (CVSS 9.4). Gemini CLI Action and GitHub Copilot Agent were similarly affected. Copilot payloads hidden in HTML comments bypassed filtering entirely.
Affected versions
| Affected | Fixed in |
|---|---|
Claude Code Security Review, Gemini CLI Action, GitHub Copilot Agent (pre-patch) | No fixed version listed |
Am I affected by this vulnerability?
You are affected if you run Claude Code Security Review, Gemini CLI Action, GitHub Copilot Agent (pre-patch).
How do I fix it?
Update to patched agent versions. Never grant AI agents write access to repos processing untrusted PRs. Sanitize all GitHub-sourced input before passing to AI agents. Adopt least-privilege tool access for CI/CD AI integrations.
How do I find every machine running Claude Code Security Review?
Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Claude Code Security Review and which version, then enforce a policy on it.