Claude Code, Gemini CLI, and GitHub Copilot Exposed to Prompt Injection via GitHub Comments

Researchers demonstrated 'Comment and Control' indirect prompt-injection attacks against GitHub-integrated AI agents (Claude, Gemini, Copilot) where attackers embed malicious instructions in PR titles, issue comments, or hidden HTML comments. These manipulations cause the agents to execute commands or include secrets (API keys, GITHUB_TOKEN) in PR/issue comments or commits, bypassing runtime filters, secret scanning, and network restrictions and resulting in high-impact credential exfiltration.