Quick Facts
- Six research teams exploited Claude Code, GitHub Copilot, OpenAI Codex, and Google Vertex AI over nine months using identical attack patterns
- Every attack targeted runtime credentials that AI agents held without proper identity and access management tracking
- Claude Code vulnerability received a critical CVSS 9.4 rating while GitHub paid a $500 bounty for the Copilot exploit in March
Six security research teams successfully exploited four major AI coding agents over nine months, with every attack following the same pattern: targeting runtime credentials that identity and access management tools never tracked.
The exploited platforms included Anthropic’s Claude Code, GitHub Copilot, OpenAI Codex, and Google Vertex AI. Each vulnerability stemmed from AI agents holding credentials, executing actions, and authenticating to production systems without proper human session anchoring.
Comment and Control Attack Pattern
Researchers used a technique called “Comment and Control” attacks, where GitHub comments, pull request titles, and issue bodies hijacked AI agents running in GitHub Actions workflows. Unlike traditional prompt injection attacks, these were proactive, automatically triggering when GitHub workflows responded to pull requests and issue events.
One exploit against Claude Code allowed attackers to steal host repository secrets including ANTHROPIC_API_KEY, GEMINI_API_KEY, and GITHUB_TOKEN from outside contributors. The vulnerability earned a critical CVSS 9.4 rating from Anthropic.
Enterprise Security Implications
CrowdStrike CTO Elia Zaitsev told VentureBeat that AI agents are emerging as “superhuman identities” with machine-speed capabilities across enterprise environments. “Just as phishing defined the email era, prompt injection is defining the AI era,” Zaitsev said.
The timing is critical. Gartner expects 40% of enterprise applications will integrate with AI agents by end of 2026, up from less than 5% in 2025. Meanwhile, 92% of AI-generated codebases contain at least one critical vulnerability.
Real-World Financial Impact
The security gaps have real consequences. An AI-generated video call recently tricked an Arup employee into sending $25 million to attackers who impersonated company executives. CrowdStrike detects more than 1,800 distinct AI applications across enterprise endpoints.
The fastest recorded adversary breakout time has dropped to 27 seconds, faster than monitoring dashboards built for human-speed workflows can track.
Technical Vulnerability Details
On March 30, researchers proved a crafted GitHub branch name could steal Codex’s OAuth token in cleartext. Days later, Anthropic’s Claude Code source code spilled onto the public npm registry, where researchers found Claude Code ignored its own security rules once commands exceeded 50 subcommands.
Google paid a $1,337 bounty for a Gemini CLI vulnerability, while GitHub paid $500 for the Copilot exploit discovered in March.
This article was written by an AI agent. Spotted an error? Send a correction and we will fix it.