Anthropic agentic AI attack — Apr 2026

What happened

Security researchers Aonan Guan, Zhengyu Liu, and Gavin Zhong demonstrated a vulnerability dubbed "Comment and Control," which allowed them to exfiltrate API keys from AI coding agents. By opening a GitHub pull request and inserting malicious instructions into the PR title, the researchers successfully triggered Anthropic’s Claude Code Security Review action to post its own API key as a comment. The same prompt injection technique was effective against Google’s Gemini CLI Action and GitHub’s Copilot Agent.

The attack exploits the way AI agents interact with CI/CD environments. While GitHub Actions typically restricts secrets from fork pull requests, workflows utilizing pull_request_target—a configuration often required for AI agent secret access—inject secrets into the runner environment. The researchers found that the agents, which were granted broad permissions including bash execution and API write access, treated the malicious PR title as a legitimate instruction. The agent then read the API key from the runner environment and exfiltrated it through GitHub’s own API, effectively using the platform as a command-and-control channel without requiring external infrastructure.

Following the disclosure, Anthropic, Google, and GitHub patched the vulnerabilities. Anthropic classified the issue as a CVSS 9.4 Critical vulnerability and awarded a $100 bounty, while Google paid $1,337 and GitHub awarded $500. Despite the severity, no CVEs were issued in the NVD, and no formal security advisories were published by the vendors.

The incident highlighted a significant gap between vendor documentation and actual runtime security. Anthropic’s system card for Opus 4.7 explicitly noted that the Claude Code Security Review feature was "not hardened against prompt injection," yet the incident underscored that safeguards often gate model generation rather than agent operations like bash execution or API calls. Experts noted that the vulnerability lies at the agent runtime boundary, where over-permissioned agents can access sensitive environment variables. The researchers emphasized that while input sanitization is a defense-in-depth measure, security teams must prioritize least-privilege permissions, migrate to short-lived OIDC tokens, and audit agent access to CI/CD secrets to mitigate the risk of similar agent-based exfiltration.