Comment and Control: One Prompt Injection Pattern Hijacked Claude Code, Gemini CLI, and GitHub Copilot Agent — And the Bug Bounties Totaled $1,937
May 5, 2026 · 13 min read · Security, Prompt Injection, Claude Code, GitHub Copilot, Gemini CLI, AI Agents, CI/CD
On April 16, 2026, three researchers — Aonan Guan, Zhengyu Liu, and Gavin Zhong — published Comment and Control, the first public cross-vendor demonstration that a single prompt-injection pattern hijacks Anthropic's Claude Code Security Review, Google's Gemini CLI Action, and GitHub Copilot Agent. The vehicle is ordinary GitHub data: PR titles, issue bodies, comments, HTML comments. The result, in all three cases, is unauthenticated credential exfiltration through GitHub itself. Total bounty paid by Anthropic, Google, and GitHub combined: $1,937. The cost shape that follows for every team running coding agents in CI in May 2026 is what nobody has costed yet.
The Disclosure Timeline
Anthropic reported 2025-10-17, paid $100, classified Critical (CVSS 9.4) then changed to "None" on 2026-04-20. Google reported 2025-10-29, paid $1,337 via the Vulnerability Reward Program (#1609699). GitHub reported 2026-02-08, initially closed as Informative / known limitation, then reopened after researcher pushback and paid $500. Anthropic's mitigation note explicitly states the GitHub Action "is not designed to be hardened against prompt injection." The product sold as "Claude Code Security Review" — an AI security tool — is not designed to withstand a security attack on its input surface.
The Attack Pattern
Every vulnerable agent runs as a GitHub Action workflow that auto-fires on pull_request, issues, or issue_comment events. The agent receives untrusted input and interpolates it into the prompt context without sanitization. The agent has access to repo secrets via environment variables: ANTHROPIC_API_KEY, GEMINI_API_KEY, GITHUB_TOKEN, plus whatever else the repo wires in. The attacker's payload tells the agent to read those environment variables, base64-encode them, and write them to a file or surface them in a security finding. The base64 step defeats GitHub's existing secret scanner: ghs_vzCpUDPykaEBOiirw1QSUuuUDjsRok1ByMZz becomes Z2hzX3Z6Q3BVR1B5a2FFQk9paXJ3MVFTVXV1VURqc1JvazFCeU1aeg==, which matches no secret-scanning regex.
Vendor Response Divergence
Anthropic added --disallow-tools 'Bash(ps:*)' and hardened the bash sandbox in Claude Code v2.1.113 (April 17). Google added new guardrail prompts to the Gemini CLI Action system prompt. GitHub disclosed an internal mitigation in the Copilot Agent runtime without specifics. None of the three treat prompt-injection-at-the-input-surface as a vendor responsibility. Each pushes the boundary of "what we secure" inward, leaving the gap between "the model" and "the runtime around the model" as the customer's problem.
Bounty-to-Risk Asymmetry
$1,937 across three vendors for cross-vendor credential exfiltration of any GitHub-integrated coding agent. The same researcher pool routinely earns five-figure bounties for less impactful application-layer bugs. The asymmetry is structural: the AI agent runtime is so new that bounty programs have not adjusted scoring, and "prompt injection" is still being treated as an inevitable property of LLMs rather than a runtime-isolation failure. A $100 bounty does not deter a credential-theft researcher who can resell the same access pattern to a state actor or a financial-fraud ring at a five- to six-figure markup.
The Cost Framing for Teams Running CI Agents
Three postures, three cost shapes. Status quo (no remediation): $0 incremental, exposed to credential theft and deployment-pipeline hijack. Hook-layer audit (pre-tool gates, environment-variable scrubbing, base64 exfiltration detection): $8K-$30K one-time engineering, $500-$2K/month ongoing. Workflow isolation (separate ephemeral GitHub App identity per agent run, scoped tokens, no inherited secrets): $25K-$60K one-time, $1K-$3K/month ongoing. The honest baseline most teams started May 2026 in is the first row.
The Pre-Tool Hook Surface Is Now a Control Plane
Every coding agent now exposes a pre-tool hook surface that fires before the model spends a single token on a tool call. .cursor/hooks.json, --disallow-tools in Claude Code, Codex CLI sandbox modes, Claude Agent SDK permissions. These were perf and ergonomic controls before Comment and Control. They are now the only control plane that fires before a hijacked agent executes the attacker's instruction. Minimum hook posture: deny destructive shell calls, scrub environment variables before agent spawn, detect base64-encoded secrets in agent output (deterministic prefixes Z2hzX, c2stX, QUtJQU, eWEyOS4), audit every tool invocation to an immutable log, treat external PR/issue/comment events as untrusted by default.
Five Lessons From Comment and Control
One: the model layer is not the attack surface — the runtime around the model is. Two: bounty programs underprice cross-vendor pattern attacks. Three: pre-tool hooks are now production controls, not perf knobs. Four: base64 in agent output is a secret-leak signal that existing scanners cannot see. Five: auto-firing GitHub Actions on external events is the highest-risk posture, and it is the default config in every coding agent's GitHub Action template.
Routing Playbook for May 2026
Inventory every coding-agent GitHub Action in your org. For each, audit the trigger model — anything firing on pull_request_target, issues, or issue_comment from external authors is highest risk. Add the pre-tool deny list (Bash(ps:*), Bash(curl:*), Bash(rm:*), extend per the destructive-shell catalog). Scrub environment variables to pass only what each agent specifically needs; use GitHub environments and OIDC for short-lived tokens. Add base64-prefix detection at the audit-log layer. Track agent-run cost separately from agent-run security cost — the two grow with fleet size at different rates.
Track agent runtime spend across Claude Code, Cursor, Copilot, and Codex in one dashboard: brew install burnrate-dev/tap/burnrate
Sources: Aonan Guan, Zhengyu Liu, Gavin Zhong "Comment and Control: Prompt Injection to Credential Theft in Claude Code, Gemini CLI, and GitHub Copilot Agent" (April 16, 2026); SecurityWeek "Claude Code, Gemini CLI, GitHub Copilot Agents Vulnerable to Prompt Injection via Comments"; VentureBeat "Three AI coding agents leaked secrets through a single prompt injection"; The Register "Anthropic, Google, Microsoft paid AI bug bounties – quietly"; Claude Code v2.1.113 changelog (April 17, 2026 bash sandbox hardening); Adversa AI Top Agentic AI Security Resources May 2026; Salt Security 1H 2026 State of AI and API Security Report; Help Net Security; Microsoft Open Source Agent Governance Toolkit (April 2, 2026).