# comment-and-control-claude-code-gemini-cli-copilot-agents-vulnerable-to: "Comment and Control": Claude Code, Gemini CLI, Copilot Agents Vulnerable to Prompt Injection via GitHub Comments

> "Comment and Control": Claude Code, Gemini CLI, Copilot Agents Vulnerable to Prompt Injection via GitHub Comments is a critical-severity prompt injection issue (CVSS 9.4) in Claude Code Security Review, an AI agent. Affected: Claude Code Security Review, Gemini CLI Action, GitHub Copilot Agent (pre-patch).

- **Canonical URL:** https://catalog.anomity.ai/vuln/comment-and-control-claude-code-gemini-cli-copilot-agents-vulnerable-to
- **Aliases:** ti-012
- **Severity:** critical
- **CVSS:** 9.4
- **Attack type:** Prompt injection, Data exfiltration
- **Component:** Claude Code Security Review (AI agent)
- **Catalog entry:** https://catalog.anomity.ai/agent/gemini-cli
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-04-16
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/comment-and-control-claude-code-gemini-cli-copilot-agents-vulnerable-to

## Summary

Johns Hopkins University researchers discovered that AI coding agents processing GitHub data (PR titles, comments, issue bodies) are vulnerable to prompt injection that triggers unauthorized command execution and credential theft. Claude Code Security Review allowed shell command injection via unsanitized PR titles (CVSS 9.4). Gemini CLI Action and GitHub Copilot Agent were similarly affected. Copilot payloads hidden in HTML comments bypassed filtering entirely.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| Claude Code Security Review, Gemini CLI Action, GitHub Copilot Agent (pre-patch) | no fixed version listed |

## Am I affected by this vulnerability?

You are affected if you run Claude Code Security Review, Gemini CLI Action, GitHub Copilot Agent (pre-patch).

## How do I fix it?

Update to patched agent versions. Never grant AI agents write access to repos processing untrusted PRs. Sanitize all GitHub-sourced input before passing to AI agents. Adopt least-privilege tool access for CI/CD AI integrations.

## How do I find every machine running Claude Code Security Review?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Claude Code Security Review and which version, then enforce a policy on it.

## References

- article: https://www.securityweek.com/claude-code-gemini-cli-github-copilot-agents-vulnerable-to-prompt-injection-via-comments/

## Related vulnerabilities

- [plugin4shell-sha-pinning-bypass-gives-zero-click-rce-across-claude-code](https://catalog.anomity.ai/vuln/plugin4shell-sha-pinning-bypass-gives-zero-click-rce-across-claude-code) — critical
- [CVE-2026-12537](https://catalog.anomity.ai/vuln/cve-2026-12537) — critical
- [cryptographic-context-injection-an-encrypted-web-page-got-github](https://catalog.anomity.ai/vuln/cryptographic-context-injection-an-encrypted-web-page-got-github) — medium
- [salesbleed-zero-click-data-exfiltration-from-salesforce-agentforce-via](https://catalog.anomity.ai/vuln/salesbleed-zero-click-data-exfiltration-from-salesforce-agentforce-via) — high
- [CVE-2026-24301](https://catalog.anomity.ai/vuln/cve-2026-24301) — high
- [ghostjacking-a-firewall-block-log-is-an-injection-channel-because-the](https://catalog.anomity.ai/vuln/ghostjacking-a-firewall-block-log-is-an-injection-channel-because-the) — high

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=comment-and-control-claude-code-gemini-cli-copilot-agents-vulnerable-to