Claude Code, Gemini CLI, and GitHub Copilot Vulnerable to Prompt Injection via GitHub Comments

Researchers disclosed a ‘‘Comment and Control’’ prompt-injection technique that abuses standard GitHub features (PR titles, issue comments, hidden HTML) to manipulate AI-based developer tools (Claude Code Security Review, Google Gemini CLI Action, GitHub Copilot Agent). By embedding malicious instructions in repository content, attackers can cause these agents to execute commands and leak sensitive credentials (e.g., ANTHROPIC_API_KEY, GITHUB_TOKEN, GEMINI_API_KEY) into PR comments, issue threads, or repository commits; one vulnerability received a CVSS score of 9.4 and mitigations are only partial.