PERMISSION/PROTOCOL
Back to incident tracker

2026-04-15

HighPrimary

Johns Hopkins researchers steal API keys from Claude Code, Gemini CLI, and GitHub Copilot via PR title prompt injection — all three vendors paid bug bounties quietly

Johns Hopkins researchers used PR title prompt injection to exfiltrate API keys and GitHub tokens from Claude Code, Gemini CLI, and GitHub Copilot. All three vendors paid bug bounties without publishing CVEs or advisories.

Claude Code Security Review / Gemini CLI Action / GitHub CopilotCredential exposurePrompt injection credential exfiltration via GitHub ActionsGitHub Actions CI/CD pipelines / repository secrets

What happened

Malicious PR title payload hijacked Claude Code Security Review, directing it to execute bash commands and exfiltrate environment variables and API keys, posted as a PR review comment

Why it matters

ANTHROPIC_API_KEY, GITHUB_TOKEN, cloud provider credentials, and any other repository secrets accessible to the Actions runner exposed. Silent patching left an unknown number of repositories on vulnerable versions without notification.

Missing authorization check

Runtime gate requiring explicit human approval before an AI agent executes tool calls (bash, env reads, secret access) triggered by untrusted PR author input

Would PP block it?

In a PP-governed deployment, the agent's tool invocations (bash execute, environment variable read) require signed receipts. The receipt request surfaces to the human operator: 'Claude Code Security Review is requesting bash execution triggered by PR #68 — approve?' The malicious PR title cannot generate a valid receipt — only a credentialed signer with MFA can. This is textbook Confused Deputy: the agent inherited credentials it didn't need and couldn't distinguish trusted operator instructions from attacker-injected payload. PP breaks this attack at the tool-call boundary before any credential is touched.

Incident analysis

Timeline and technical read

Timeline

  1. 2025-10

    Aonan Guan (Johns Hopkins) submits initial prompt injection finding against Claude Code Security Review to Anthropic via HackerOne

  2. 2025-11

    Anthropic pays $100 bug bounty, upgrades severity from CVSS 9.3 to 9.4; updates documentation with security warning; no CVE assigned, no public advisory

  3. 2026-Q1

    Guan extends attack to Google Gemini CLI Action and Microsoft GitHub Copilot — both vulnerable, both pay bug bounties without advisories

  4. 2026-04-15

    The Register publishes exclusive interview with Guan; research published at oddguan.com

  5. 2026-04-16

    Secondary coverage by GBHackers, Winbuzzer confirms silent-patching pattern and ongoing exposure for pinned-version users

Technical breakdown

  • Attack vector: PR title injection — all three affected agents read GitHub data (PR titles, issue bodies, comments) as trusted task context, making them hijackable by any PR author with repo access
  • All three agents share the same vulnerable data flow: read GitHub data → process as task context → execute tool calls with full Actions runner permissions
  • Post-exfiltration cleanup: attacker changes PR title back to innocuous text ('fix typo'), closes PR, deletes bot's review comment — leaves minimal forensic trace
  • Credentials exposed include GITHUB_TOKEN, ANTHROPIC_API_KEY, and any cloud provider secrets available to the Actions runner environment
  • Guan estimates the pattern extends to all agents integrating with GitHub Actions — Slack bots, Jira agents, deployment automation — not only the three confirmed affected vendors

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Credential exposure. The relevant Permission Protocol gate is Credential Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at
Agent tool-call boundary (bash execute, environment variable and secret reads)
Still needs
Repositories using the upstream GitHub Actions without a PP-governed wrapper — the Actions are unprotected by default and will remain vulnerable on pinned versions
Receipt required for
Bash execution, environment variable reads, and any secret access triggered during AI agent PR review

PP enforces at the tool-call layer — a receipt is required before the agent executes bash commands or reads environment secrets. An attacker-injected PR title cannot authorize its own receipt; only a credentialed human signer can. This is the Confused Deputy problem PP was designed to solve.

Start small

Put the relevant gate at this action boundary.

This incident maps to Credential Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Replay this incident with a signer in the loop