Claude Code, Gemini CLI, GitHub Copilot agents hijacked via PR/issue comment prompt injection
Date: 2026-04
Affected: Anthropic, Google, Microsoft GitHub
Attack vector: prompt-injection
Category: real-world
Severity: High

Researchers showed that Anthropic Claude Code Security Review, Google Gemini CLI Action and GitHub Copilot Agent could be hijacked via specially crafted GitHub comments (PR titles, comments, issue bodies) that cause the AI agents to perform unintended privileged actions. Bug bounties paid quietly.


Mitigations:

Architectural layers (MAESTRO):