Anthropic, Google and Microsoft quietly patched AI agent bugs with no CVEs or public warnings

The problem with AI agents in software development turned out not to be theoretical. Security researcher Aonan Guan showed that tools from Anthropic, Google and Microsoft built into GitHub Actions can be hijacked through prompt injection and turned into a channel for leaking secrets. In all three cases, the agent only had to read text prepared by an attacker in its ordinary working context, and it then published API keys, GitHub tokens and other data from the CI environment itself.

The attack was named Comment and Control. The malicious instructions are not hidden in a separate exploit or on an external server. They sit directly in the GitHub data the agent has to read anyway to do its job: in a pull request title, an issue description, comments and, in one scenario, even a hidden HTML comment. The agent then treats that text as a command rather than as data.

The scheme is simple. The bot reads the injected instruction, runs the requested action, pulls secrets from the GitHub Actions runtime environment and posts the result back to GitHub itself, for example in a PR comment, an issue comment, a commit or a pipeline log.

At Anthropic, the vulnerable component was Claude Code Security Review, a GitHub Action that checks pull requests for security problems. Guan showed that injecting a payload into the PR title was enough to make the agent execute commands and include the output in its JSON response, which was then published as a comment. According to the researcher, the report was sent to Anthropic on October 17, 2025. The company rated the issue CVSS 9.4 and paid a $100 bug bounty on November 25. The fix amounted to a partial restriction on dangerous calls and an updated security considerations section in the documentation. The company issued neither a public security advisory nor a separate CVE.

A similar scenario worked against Google's Gemini CLI Action. Here the attacker added text to an issue and its comments that posed as a trusted piece of context and overrode the model's protective instructions. As a result, the agent posted its own GEMINI_API_KEY as an ordinary comment. According to Guan's timeline, Google received the report on October 29, 2025 and paid $1,337 on January 20, 2026.

The case of GitHub Copilot Agent, part of Microsoft's product line, was even more interesting. The malicious instruction was placed in an HTML comment that is invisible to humans in rendered Markdown but readable by the agent. Once assigned the task, Copilot followed those instructions despite additional protective layers such as environment filtering, secret scanning and network restrictions. GitHub first closed the report as informative, then reopened it after a second review and paid $500 on March 9.

The most troubling finding is not the size of the bounties but the disclosure model. Neither Anthropic, nor Google, nor GitHub issued public warnings in the format security teams are used to, and no CVEs were ever assigned for these cases. That means teams that pinned older versions of the actions or integrations may never have learned about the risk. To vulnerability scanners, the problem effectively does not exist, because it has no standard identifier. For security teams, it is harder to put under control, track in registries and tie into internal patching procedures.

The companies may formally have considered prompt injection not a classic code bug but a side effect of agent architecture. In practical terms, though, the consequences match those of an ordinary critical vulnerability: leaked access keys and tokens from the environment where automation runs.

The story also matters because it hits the basic assumption behind the whole wave of AI automation in development. An agent is given access to untrusted user input, to command-execution tools and to sensitive secrets at the same time, because otherwise it cannot do useful work. That combination is what creates the systemic risk. If the industry keeps embedding such agents in code review, triage, deployment and CI/CD without a proper isolation model and incident disclosure, attacks like these will become an ordinary part of the threat model rather than an exception.