When Untrusted Text Becomes Operational Authority: Why Agentic Coding Tools Are Unsafe Without a Governance Substrate
Year: 2026
Type: article
Abstract: On April 15–16, 2026, security researcher Aonan Guan and collaborators at Johns Hopkins University disclosed a cross‑vendor prompt injection attack class — “Comment and Control” — demonstrating that Claude Code Security Review, Google Gemini CLI Action, and GitHub Copilot Agent could each be hijacked via standard GitHub content such as pull request titles, issue bodies, and comments. Credentials including ANTHROPIC_API_KEY, GEMINI_API_KEY, and GITHUB_TOKEN were exfiltrated back through GitHub itself, requiring no external infrastructure. Anthropic classified the Claude Code vulnerability CVSS 9.4 Critical, and all three vendors confirmed the findings. This paper argues that Comment and Control is not merely a collection of vulnerabilities but a predictable consequence of an architecture that collapses meaning and authority into the same channel. The structural flaw is not limited to specific implementations or access patterns; it arises wherever agentic systems consume ungoverned instruction surfaces as both context and control. The analysis distinguishes this failure mode from classic prompt injection and articulates requirements for an instruction‑and‑execution architecture that can withstand Comment‑and‑Control‑class attacks.
Author: Truong, Narnaiezzsshaa
Language: English
Subfield: Artificial Intelligence
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7155104853
FWCI:
Cites:
Cited by:
Related to: