From Comments to Credentials: How Attackers Hijack AI Coding Agents in CI/CD

Major AI coding agents deployed in GitHub Actions—including Claude Code, Gemini CLI, and GitHub Copilot—are vulnerable to a fundamental architectural flaw: attackers with minimal privileges can inject malicious prompts through public comments to exfiltrate sensitive secrets. Rated CVSS 9.4 Critical, this vulnerability cannot be patched inside the agents themselves since their core function is to read and act on untrusted input.