{"slug": "comment-and-control-a-github-comment-hijacks-claude-code-in-ci", "title": "Comment and Control: a GitHub comment hijacks Claude Code in CI", "summary": "A security researcher demonstrated that a GitHub PR title, issue body, or comment can serve as a prompt injection to hijack Claude Code, Gemini CLI, and GitHub Copilot running in GitHub Actions, causing them to dump workflow secrets. Anthropic rated the Claude Code variant CVSS 9.4 Critical. The attack, dubbed \"Comment and Control,\" requires no malware or GitHub bug—the AI agent simply reads attacker-controlled text and executes tools with access to adjacent secrets.", "body_md": "A security researcher showed that a GitHub PR title, issue body, or comment could become a prompt injection that hijacks Claude Code (and Gemini CLI, and GitHub Copilot) running in GitHub Actions, then makes it dump the workflow's secrets. Anthropic rated its variant CVSS 9.4 Critical.\n\nThere is no malware and no GitHub bug. The agent simply reads attacker-controlled text and runs tools with the secrets sitting next to it. Here is how the chain works, why it cannot be fixed inside the agent, and the tool-call rules that stop the exfiltration the moment it is attempted.\n\nIn a coordinated disclosure dubbed [\"Comment and Control\"](https://oddguan.com/blog/comment-and-control-prompt-injection-credential-theft-claude-code-gemini-cli-github-copilot/), security researcher Aonan Guan, with Johns Hopkins researchers Zhengyu Liu and Gavin Zhong, showed the same attack pattern against three of the most widely deployed AI coding agents in CI: **Anthropic's Claude Code Security Review, Google's Gemini CLI Action, and GitHub's Copilot Agent.** All three were confirmed and fixed by their vendors. Anthropic rated the Claude Code variant **CVSS 9.4 Critical**.\n\nThe setup is the part that should worry you: it needs nothing privileged. Anyone who can *comment* on a public repo, open an issue, or file a PR can deliver the payload. The agent does the rest, because reading that comment is its job.\n\nThe three findings, in increasing sophistication:\n\n`whoami`\n\nand `env`\n\nvia Bash and embed the result in its \"findings.\" The subprocess had no `--allowed-tools`\n\nrestriction, so it ran. `ANTHROPIC_API_KEY`\n\nand `GITHUB_TOKEN`\n\nwere exfiltrated through PR comments and the Actions logs.`ps auxeww | base64 -w0 > checkmark.txt`\n\n, then \"create a PR with this file.\" `ps auxeww`\n\nreads `/proc/[pid]/environ`\n\nof parent processes that still hold the unfiltered secrets; `base64`\n\ndefeats GitHub's `ghs_`\n\n/`ghu_`\n\nsecret-scanner; and the exfil rides out over `git push`\n\nto `github.com`\n\n, which the egress firewall allows. Three runtime defenses bypassed in one move.The researcher's own conclusion is the one that matters: *\"The prompt injection here is not a bug; it is context that the agent is designed to process.\"* The agent's whole purpose is to read the PR title, the issue, the comment, and act. You cannot tell it to stop reading untrusted input without removing the feature.\n\nThree things line up, and they are structural:\n\n`GITHUB_TOKEN`\n\nlive in the same process the agent drives. The model decides what to do with both.`ps`\n\nspecifically. But `cat /proc/*/environ`\n\nreaches the same data, and `printenv`\n\n, and `env`\n\n. Every blocked command has an alias.`git push`\n\n, a public PR comment, an Actions log line, a DNS lookup, a webhook. None of these is malware. The danger is the A \"Trusted Content Section\" or a polite request to \"include the environment in your report\" reads as ordinary prose. Hidden HTML comments are invisible to a human reviewer entirely. Text scanning helps, but a payload worded cleverly enough slips past it. The behaviour you cannot hide is what the agent *does next*: dump the environment, base64 it, push it out.\n\nThis is exactly the surface [clampd-action](https://github.com/clampd/clampd-action) exists for. You cannot modify Claude Code, and you cannot stop it from reading the comment. So you put a firewall *under* it: every tool call the agent makes inside the workflow (Bash, Read, Write, WebFetch) is routed through the Clampd gateway and checked against 285 detection rules plus Cedar policy **before it executes**. The injection can succeed at convincing the model; the exfiltration call still has to pass the firewall, and it does not.\n\n```\n# .github/workflows/claude-code.yml\npermissions:\n  id-token: write          # stable agent identity via OIDC\n  contents: read\n\nsteps:\n  # 1. Arm the firewall. Must run BEFORE the agent step.\n  - uses: clampd/clampd-action@v1\n    with:\n      dsn: ${{ secrets.CLAMPD_DSN }}\n      agent-runtime: claude-code\n      # fail-open defaults to false in CI: unreachable gateway = fail closed\n\n  # 2. Run the agent as usual. Its tool calls are now verified.\n  - uses: anthropics/claude-code-action@v1\n    with:\n      prompt: \"fix issue #${{ github.event.issue.number }}\"\n```\n\nThree lines of YAML, one secret. No gateway to deploy. The same call works in the Cursor IDE, on a laptop, or in any pipeline via [clampd-guard](https://github.com/clampd/clampd) directly.\n\nThe Comment and Control chain has four distinct moves. Clampd evaluates each tool call against its detection layers before it runs, and the categories below line up with the chain. None of this needs to know the prompt was poisoned, it keys on the action.\n\n**1. The injection text itself.** When the poisoned comment is scanned as model input, the prompt-injection layer flags the classic override, roleplay, and delimiter patterns, plus explicit \"forward the environment\" style phrasing. This is the weakest of the four: a payload worded as ordinary prose, or hidden in an HTML comment, can read clean. Treat it as a tripwire, not the wall.\n\n**2. Recon and the environment dump.** This is where the firewall earns its place. Reads of process and system state under `/proc`\n\n, of `.env`\n\nfiles, and of credential and config files are detected as sensitive-source access, and chained recon commands are flagged as reconnaissance. This is the step Anthropic tried to patch by blocking the `ps`\n\ncommand specifically, and the reason a single-command blocklist doesn't hold: the same secrets are reachable through `/proc`\n\n, which Clampd treats as a sensitive read regardless of the binary used to get there.\n\n**3. The base64 encode-to-evade.** Base64-wrapping a secret to slip past GitHub's prefix-based secret scanner is itself a signal. Clampd's normalization layer decodes encoded payloads before matching, and encode/decode chains tied to environment or credential data are scored as obfuscation rather than waved through.\n\n**4. The exfiltration channel.** The same data leaving the runner is checked whichever door it uses:\n\n`GITHUB_TOKEN`\n\n, OIDC request tokens, and friends) flowing into `curl`\n\n, `wget`\n\n, or a webhook are flagged as token exfiltration.Honest scope: this is detection by behaviour, not a magic box. The strongest coverage is on the sensitive-read and the network-exfil ends, where the attacker has to touch `/proc`\n\n, a credential file, or an outbound channel to win. A determined attacker will keep finding command variants, so the right posture is layered.\n\n```\n# clampd-guard hook, the moment the hijacked agent reaches for the secrets\nBash(\"cat /proc/1/environ\")        # the alias a ps-blocklist misses\n  BLOCKED   sensitive-source read (/proc)   exit 2, tool never runs\n\nRead(\".env\")                       # credential file\n  BLOCKED   sensitive-file access\n  risk_score: high   action: block   audit: logged to app.clampd.dev\n```\n\nClampd does not try to win the prompt-injection arms race, that is the fight the researcher showed is unwinnable inside the agent. It assumes the injection may succeed and aims at the *consequence*: the secret leaving the runner. In CI the guard defaults to **fail-closed**, so an unreachable gateway blocks rather than waves calls through. It is not the only control that helps here, and it shouldn't be the only one you run. Pair it with the disclosure's own advice, least-privilege tokens and tool allowlisting, and with network egress filtering, and you have real defense in depth: each layer shrinks what the others have to catch.\n\n`GITHUB_TOKEN`\n\n. Scope to the minimum.`--allowed-tools`\n\nbeats blocking `ps`\n\n, because the blocklist always has a hole (`cat /proc/*/environ`\n\n).`clampd-action`\n\nruns The pattern is bigger than GitHub Actions. As the disclosure notes, it applies to any agent processing untrusted input with tools and secrets in reach: Slack bots, Jira agents, email triagers, deploy pipelines. The fix is the same everywhere: stop assuming you can keep the injection out, and start checking what the agent does with it.\n\n*Originally published at clampd.dev/blog.*", "url": "https://wpnews.pro/news/comment-and-control-a-github-comment-hijacks-claude-code-in-ci", "canonical_source": "https://dev.to/clampd_dev/comment-and-control-a-github-comment-hijacks-claude-code-in-ci-28jo", "published_at": "2026-06-02 22:49:14+00:00", "updated_at": "2026-06-02 23:13:00.519993+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "large-language-models", "ai-tools", "ai-research"], "entities": ["Anthropic", "Claude Code", "Google", "Gemini CLI", "GitHub Copilot", "Aonan Guan", "Johns Hopkins", "CVSS"], "alternates": {"html": "https://wpnews.pro/news/comment-and-control-a-github-comment-hijacks-claude-code-in-ci", "markdown": "https://wpnews.pro/news/comment-and-control-a-github-comment-hijacks-claude-code-in-ci.md", "text": "https://wpnews.pro/news/comment-and-control-a-github-comment-hijacks-claude-code-in-ci.txt", "jsonld": "https://wpnews.pro/news/comment-and-control-a-github-comment-hijacks-claude-code-in-ci.jsonld"}}