Vulnerability / research

Comment and Control exposes coding-agent credentials

Reported

What happened

Researchers used attacker-controlled repository comments, issues and pull-request metadata to make coding agents expose credentials through normal GitHub workflows.

Parties and reporting

AI tools and systems: Claude Code Security Review, Gemini CLI Action, GitHub Copilot Agent

Outcome

Vendors acknowledged or mitigated parts of the findings; severity assessments and remediation differed across products.

Operating lesson

Treat repository discussion as untrusted input and restrict agent access to secrets and outbound publishing.

Evidence and limits

Research demonstrations, not confirmed victim breaches. Anthropic later disputed severity; the report does not establish complete cross-vendor remediation.

Sources