Agents gone wrong
One PR title was enough: 4,714 GitHub workflows with AI agents could be hijacked to leak secrets
Security researchers showed in April 2026 that Claude Code Security Review, Gemini CLI Action and GitHub Copilot Agent, running in GitHub Actions, would follow instructions hidden in a PR title, an issue or a comment and hand back the repository's API keys and tokens. Their paper then scanned public workflows for the same flaw.
What the agent did
- Claude Code Security Review: an injected PR title made the agent run shell commands and post ANTHROPIC_API_KEY and GITHUB_TOKEN in its review comment
- Gemini CLI Action: a comment with a fake 'trusted content' section made the agent publish its GEMINI_API_KEY in a public issue comment
- GitHub Copilot Agent: instructions hidden in an HTML comment got past three extra runtime defenses, with tokens base64-encoded and pushed as a commit
- The paper's tool found 4,714 GitHub workflows and 8 n8n templates that could be hijacked, across 15 widely used Actions
- Bounties: $100 from Anthropic, $1,337 from Google, $500 from GitHub; Anthropic later changed its rating from Critical (9.4) to None
What it means for you
- Never run an AI agent with secrets and a shell on events that strangers can trigger (pull_request_target, issues, issue_comment). Gate it behind a maintainer label or a manual run.
- Give review agents a narrow tool allowlist and no Bash, and pass only the one secret they need. Assume anything in the runner environment can leak.
- Treat PR titles, issue bodies and hidden HTML comments as untrusted data, and remember that encoding defeats secret scanning.
Why it matters
The agent has to read untrusted text to do its job and holds secrets to act on it. Put both in one runner and a single comment can turn the agent against the repository. Model-level and prompt-level defenses did not stop it, and even GitHub's extra runtime layers were bypassed.
This is security research, not an attack seen in the wild; vendor responses and bounty amounts are as reported by the researchers.
Source: arXiv 2605.11229; researcher's write-up
Every number on this page comes from the source. Our charts redraw those numbers; videos are embedded from the publisher.
Comments
- Tried something like this? Share how it went for you.
Agents in this story
| # | Agent | Gid Score | Downloads 7d | 7d | 30d | Stars | Latest release | ||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| 2 |
|
83 | 12.1M | down 4.6% | down 12.5% | 154K+137/day | 2.1.316yesterday | ||||
| 18 |
Gemini CLIGoogle |
60 | 446K | up 10.1% | up 3.1% | 109K+71/day | 0.66.05d ago | ||||
| 11 |
|
68 | — | — | — | — | — | ||||
| 202 |
Cursor CLICursor |
23 | — | — | — | — | — | ||||
| No agents match that filter. | |||||||||||
More agents in action
Agents gone wrongA Cursor agent wiped PocketOS's production database in 9 seconds with one API call
Agents gone wrongA Claude triage bot open to any GitHub user led to an unauthorized Cline CLI release on npm
Agents in actionWorldwide Express agents close 10,000 freight billing exceptions a week and cut the backlog 75%