Agents hooked into GitHub can steal creds – but Anthropic, Google, and Microsoft haven't warned users

Security researchers discovered and demonstrated a "comment-and-control" prompt-injection technique that hijacks AI agents running in GitHub Actions (Anthropic Claude Code Security Review, Google Gemini CLI Action, GitHub Copilot Agent) to exfiltrate API keys and GitHub tokens by injecting malicious instructions into PR titles, issue bodies, and hidden HTML comments. Vendors paid bounties but did not publish advisories, leaving users pinned to vulnerable versions at risk; recommended mitigations include least-privilege for agents, disabling unnecessary tools, and requiring human review for external contributions.