Researchers Show GitHub AI Agents Can Leak Secrets via Prompt Injection

Security researcher Aonan Guan and Johns Hopkins collaborators disclosed on April 15 that prompt injection in GitHub pull requests and issues could make Claude Code Security Review, Gemini CLI Action, and GitHub Copilot Agent expose workflow secrets through GitHub itself. Anthropic, Google, and GitHub paid bounties of $100, $1,337, and $500; the researchers said the shared risk is agents processing untrusted text while holding tools and credentials.

Researchers Show GitHub AI Agents Can Leak Secrets via Prompt Injection Security researcher Aonan Guan and Johns Hopkins collaborators disclosed on April 15 that prompt injection in GitHub pull requests and issues could make Claude Code Security Review, Gemini CLI Action, and GitHub Copilot Agent expose workflow secrets through GitHub itself. Anthropic, Google, and GitHub paid bounties of $100, $1,337, and $500; the researchers said the shared risk is agents processing untrusted text while holding tools and credentials. Security researcher Aonan Guan, working with Johns Hopkins University researchers Zhengyu Liu and Gavin Zhong, publicly disclosed the cross-vendor “Comment and Control” attack pattern on April 15, 2026. Their tests showed that attacker-controlled pull request titles, issue bodies, and issue comments could steer three AI agents running in or alongside GitHub workflows into exposing credentials. The affected demonstrations involved Anthropic’s Claude Code Security Review, Google’s Gemini CLI Action, and GitHub Copilot Agent. The researchers reported the underlying issues to the vendors before publication and received bounties of $100, $1,337, and $500, respectively. What the researchers demonstrated The common attack path began with GitHub content that an outside contributor could influence. An agent read that content as part of its task context, treated malicious text as instructions, used tools available inside the workflow, and returned sensitive output through a GitHub-native channel. The exact route differed by product. A crafted pull request title led Claude Code Security Review to run commands and place results in a review response. A malicious issue flow made Gemini CLI Action reveal an API key in an issue comment. For GitHub Copilot Agent, the researchers hid instructions in an HTML comment; that variant still required a person to assign the issue to Copilot before the agent processed the hidden payload. The demonstrations targeted secrets available to the workflow, including provider API keys and GitHub tokens. GitHub itself served as the return channel through comments, logs, or commits, reducing the value of defenses that look only for traffic to an unfamiliar external server. One trust failure across three agents The finding is not that every repository using an AI agent automatically exposes secrets. GitHub Actions does not normally pass secrets to workflows from untrusted forks, and exploitability depends on triggers, permissions, tools, and credentials available to the agent. The broader design problem is the combination of untrusted natural-language input and privileged execution. An agent that can read public contribution text, run shell or file tools, access credentials, and publish output can turn prompt injection into a credential-exfiltration path when those capabilities are not separated. What platform teams should review Teams using AI inside CI/CD should inventory workflows triggered by pull requests, issues, and comments; minimize token permissions; keep unnecessary secrets out of agent runtimes; require review before untrusted contributors trigger privileged jobs; and monitor agent-written comments, logs, and commits for sensitive output. Those controls limit the blast radius even when model-level prompt defenses fail. The practical boundary belongs in workflow permissions, secret isolation, tool allowlists, and approval gates—not only in the instructions given to the model. Key Points - 1Aonan Guan, Zhengyu Liu, and Gavin Zhong publicly disclosed the cross-vendor Comment and Control attack pattern on April 15, 2026. - 2Prompt injection was demonstrated against Claude Code Security Review, Gemini CLI Action, and GitHub Copilot Agent, using GitHub-native channels to expose workflow secrets. - 3Exploitability depends on workflow triggers, tool access, token permissions, and which secrets are available to the agent. Scoring Rationale The cross-vendor research demonstrates a concrete credential-exfiltration risk in AI-enabled GitHub workflows. Its operational impact depends on repository triggers, agent permissions, tool access, and whether privileged secrets are present. Sources Primary source and supporting public references used for this report. Practice interview problems based on real data 1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with. Try 250 free problems /problems