Your agent reads the attacker's payload

Research cutoff: November 1, 2026. Statuses reflect sources available on that date; the Comment and Control paper appeared on arXiv on May 11, 2026 and the disclosure write-up on April 15, 2026.

§1 · Executive summary

9.4 → None: the same hijack, two verdicts

A crafted PR title turned a security-review agent into a credential thief. Anthropic scored the finding Critical, then scored it nothing.

In October 2025, security researcher Aonan Guan reported a prompt injection in Anthropic's Claude Code Security Review GitHub Action. The Action interpolated the pull request's title straight into the security-audit prompt, invoked the Claude CLI without a tool allowlist, and inherited every environment variable in the runner. A PR title carrying a break-out instruction made the reviewer run whoami and ps auxeww, then publish the results as a “security finding” — including ANTHROPIC_API_KEY and GITHUB_TOKEN.

Two more agents fell to the same pattern. Google's Gemini CLI Action accepted a fake “Trusted Content Section” typed into an issue comment and posted the repository's GEMINI_API_KEY as a public reply. GitHub's Copilot Agent read a hidden HTML comment in an issue body — invisible in rendered Markdown — and committed a 158 KB base64 dump of the runner's process environment, defeating environment filtering, secret scanning and a network firewall in one move. The whole loop ran inside GitHub: a comment went in, credentials came out.

The disclosure record is the report's first surprise. Anthropic rated the Claude Code finding Critical at CVSS 9.3, upgraded it to 9.4, paid $100 — then re-rated it None on April 20, 2026. Google paid $1,337, GitHub $500. Combined, three cross-vendor hijacks of production agents were priced at $1,937, with no CVE and no public advisory for any of them. The severity of an agent hijack is currently a vendor policy choice, not a measured risk.

The academic record is broader than the blog. The authors' framework, JAW, combines static path-feasibility analysis, dynamic prompt-provenance analysis and runtime capability profiling to evolve payloads that fit each workflow's constraints. It found 4,174 hijackable GitHub workflows and eight n8n templates across 15 widely used Actions — including official Actions for Claude Code, Gemini CLI, Qwen CLI and Cursor CLI — with seven acknowledgments and seven fixes after a 45-day remediation window. The arXiv abstract metadata prints 4,714; the paper body and evaluation section print 4,174. This report uses the body value and carries the discrepancy as a contradiction rather than averaging it.

The root cause is architectural, and the discloser says so plainly: the payload is not a parser flaw but context the agent is designed to process. Any agent that must read untrusted data to do its job can be steered by that data. The useful question is therefore not “how do we stop injection?” but “what can a hijacked agent still do?”

The answer this report defends: prevention is not available on the evidence; containment is. No tested defense has held under adaptive attack without a measured utility or coverage cost, and no shipped vendor control has been independently retested. What holds is bounding capability — least privilege, allowlisted tools and secrets, approval for risky actions, egress restrictions, and monitored tool calls.

§2 · The hijack loop · 2025–2026

The whole attack loop runs inside GitHub

No external server, no phishing email: a comment is the command channel. The agent's job is to read the comment.

Classic indirect injection is reactive: the attacker plants a payload and waits for a victim to ask the model to read it. Comment and Control is proactive. GitHub Actions workflows fire on pull_request, issues and issue_comment events, so opening a PR or filing an issue can start the agent without any action from the maintainer. Repello AI reproduced all three variants in its ARTEMIS CI-agent test suite — independent practitioner corroboration that still produced no CVE. The Copilot variant needed a victim to assign the issue, but the instructions sat in an HTML comment that rendered as nothing.

The anatomy is five steps: untrusted data enters the context window; the model plans; a tool call executes; a capability is used; and the result leaves through a channel the platform already trusts — a PR comment, an issue comment, a git commit, or the Actions log. No external command-and-control server is required; the loop is entirely within GitHub. The exfiltration channel is not an exploit. It is the product working as designed.

Each of GitHub's three runtime defenses was real, and each was defeated by the shape of the runtime. The environment filter applied only to the child bash process, so ps auxeww read /proc/[pid]/environ of the parent and MCP server that still held the tokens. Secret scanning matched ghs_ and ghu_ prefixes, so base64 defeated it. The network firewall allowed github.com, and git push is a standard operation. Anthropic's mitigation was narrower still: a blocklist of ps that left cat /proc/*/environ available. Blocklists are whack-a-mole; the payload only has to find one equivalent primitive.

JAW shows the pattern is automatable. Path-feasibility analysis finds which workflows an outsider can trigger; prompt-provenance analysis finds how the input is embedded; capability profiling finds what the agent can do at runtime. The payload is then evolved against those constraints, not against the model in general. That is why the paper's count is a workflow count, not a model count: the vulnerability lives in the workflow template, not in the LLM.

The disclosure lag is its own signal. Claude Code took 185 days from first report to the severity change; Gemini 83 days; Copilot 29 days. Only one of the three ended with a public severity that reflects the original finding, and none ended with an advisory. The discloser's warning is the practical consequence: users pinned to vulnerable action versions may never know they were exposed.

§3 · Attack taxonomy

Eight surfaces, one grammar

The payload does not need to be visible to the victim. A hidden HTML comment is legitimate context.

Indirect prompt injection was named in 2023: Greshake et al. showed that prompts injected into data likely to be retrieved blur the line between data and instructions, and derived a taxonomy of delivery methods — passive retrieval, active delivery such as email, user-driven and hidden — plus six threat categories. The core premise has not changed: the model has no reliable way to know which text is an instruction and which is content.

Simon Willison's “lethal trifecta” names the capability combination that turns injection into exfiltration: access to private data, exposure to untrusted content, and the ability to communicate externally. Remove any leg and the attack loses either its payload, its target or its exit. The Comment and Control agents had all three.

Standards have since codified the surface. MITRE ATLAS lists prompt injection as AML.T0051 with an indirect sub-technique, and separately lists AI agent context poisoning as AML.T0080 with memory and thread sub-techniques. NIST AI 100-2 devotes a section to indirect prompt injection and advises designing systems on the assumption that injection is possible. CWE-1427 gives it a weakness class, and OWASP ranks it LLM01:2025 — the top LLM risk. Agent Skills add another surface: hidden instructions in long SKILL.md files that a coding agent loads as trusted context.

The field record before Comment and Control: Amazon Q Business appended chat data to attacker-supplied links in 2023; Slack AI posted private-channel data as a markdown image after a public-channel injection, and Slack called the channel behaviour “intended”; Amazon Q Developer's VS Code extension failed to sanitize invisible Unicode tag characters; EchoLeak (CVE-2025-32711, CVSS 9.3) exfiltrated from Microsoft 365 Copilot zero-click; MCP tool poisoning hid instructions in tool descriptions; the official GitHub MCP server was coerced by a malicious issue; CVE-2025-53773 and two Cursor CVEs turned prompt injection into code execution; Pillar Security hid payloads in rule files with Unicode.

The scale cases matter more than any single product. Aikido's PromptPwnd found CI/CD workflows embedding untrusted issue, PR or commit text into agent prompts, with at least five Fortune 500 companies affected. In the s1ngularity supply-chain attack, compromised Nx packages ran installed Claude, Gemini and Amazon Q CLI agents with permission checks disabled and searched developer machines for secrets. Anthropic reported a group it assesses as Chinese state-sponsored using a jailbroken Claude Code against about 30 targets, succeeding in a small number. Microsoft documented “AI recommendation poisoning”: hidden instructions in “Summarize with AI” buttons across 31 companies and 14 industries. A support ticket was enough to make a Cursor agent exfiltrate a Supabase service_role key.

§4 · Memory and context poisoning

A poisoned memory outlives the session

One injection becomes many: the poison is retrieved later, for a different user, with the agent's own authority. Persistence is the amplifier.

Agents keep state: conversation summaries, user preferences, retrieved facts, tool observations. OWASP's ASI06 defines the failure: adversaries corrupt or seed that context so future reasoning, planning or tool use becomes biased, unsafe or useful to exfiltration. Memory is a write target that survives the session, so a single successful injection can be replayed without the attacker present.

The measured attacks are not marginal. AgentPoison reports an average attack success rate above 80% with less than 1% benign performance impact and a poison rate below 0.1%. PoisonedRAG reports 90% attack success by injecting five malicious texts into a database of millions. MemSecBench traces the same malicious memory semantics across lifecycle checkpoints and finds malicious memory persists in 84.2% of cases, with the full write-execute chain succeeding in 50.3%. Sleeper-memory poisoning plants fabricated user memories from external context and adds up to 99.8% on GPT-5.5 and 95% on Kimi-K2.6; among successful retrievals, 60–89% produced attacker-intended actions. MemMorph biases tool selection with three injected records at up to 85.9% attack success. eTAMP shows web agents can be memory-poisoned through environmental observation alone, up to 32.5% on GPT-5-mini.

Propagation is the second amplifier. Morris II demonstrated a zero-click, self-replicating prompt worm cascading between GenAI-powered applications; Prompt Infection shows LLM-to-LLM injection inside multi-agent systems. Backdoors can also survive training: sleeper agents persist through supervised fine-tuning, reinforcement learning and adversarial training.

These numbers come from different benchmarks with different denominators — fraction of memory entries, absolute count of texts, lifecycle checkpoints, model-specific evaluations. They are evidence of direction and magnitude, not a ranking. What they agree on: small poison volumes suffice, persistence is high, and the effect surfaces in later decisions rather than the poisoned turn.

The defenses are early. Memory write validation, provenance and isolation are the proposals, and OWASP's ASI06 lists memory integrity checks. But no standard persistence-window metric existed before MemSecBench, and no cross-vendor production data exists.

§5 · OWASP Top 10 for Agentic Applications 2026

The standard named ten risks; the record supplies the evidence

OWASP's 2026 list is the first agent-specific risk framework. Nine of its ten categories have a documented instance in this report's register; the tenth has no denominator.

OWASP published the Top 10 for Agentic Applications 2026 on December 9, 2025, peer-reviewed with more than 100 industry experts. The list: ASI01 Agent Goal Hijack, ASI02 Tool Misuse and Exploitation, ASI03 Identity and Privilege Abuse, ASI04 Agentic Supply Chain Vulnerabilities, ASI05 Unexpected Code Execution (RCE), ASI06 Memory and Context Poisoning, ASI07 Insecure Inter-Agent Communication, ASI08 Cascading Agent Failures, ASI09 Human-Agent Trust Exploitation, ASI10 Rogue Agents.

The ordering is judgement, not measurement: OWASP publishes no numeric methodology or incident-frequency basis. But the mapping to this report's record is direct. ASI01 is the Comment and Control class; ASI02 is MCP tool poisoning; ASI03 is the Copilot token theft; ASI04 is PromptPwnd and s1ngularity; ASI05 is the Cursor and Copilot CVEs; ASI06 is memory poisoning; ASI07 is Prompt Infection; ASI08 has no clean field instance; ASI09 is the approval-gate problem; ASI10 is the espionage campaign.

The earlier OWASP agentic guide (February 2025) had a 17-threat model, T1–T17, with memory poisoning already at T1. Its cross-references to the new list do not line up: ASI06 cites “T4 Memory Overload” and “T12 Shared Memory Poisoning”, but that guide names T4 Resource Overload and T12 Agent Communication Poisoning. The taxonomy is maturing faster than its crosswalks.

Adjacent standards agree on the shape of the problem even where they disagree on fixability. The UK NCSC argues prompt injection is a confused-deputy problem, not an input-validation bug, and may never be totally mitigated. NIST advises designing for compromise. OWASP's secure MCP guide names tool poisoning and dynamic “rug pulls” as MCP-specific risks. Ecosystem measurement is still noisy: MCPZoo catalogs 64,611 unique MCP servers and finds scanner-reported risk rates above 96%, while fewer than half of sampled alerts are true positives.

§6 · Defenses and their measured cost

Least privilege survived every bypass

Anthropic blocked ps; cat /proc/*/environ did the same thing. Blocklists are whack-a-mole; allowlists and containment are the posture.

The benchmark record is unambiguous about the baseline. AgentDojo's undefended GPT-4o agent meets the attacker's goal in 57.69% of 629 security cases, with benign utility of 69.0%. A tool-filter isolation defense cuts that to 6.84% while keeping 73.13% benign utility, but it leaves 17% of cases uncovered because the tools needed for the task are also sufficient for the attack. A secondary attack detector reaches 7.95% attack success, but utility under attack collapses to 21.14% against 50.01% undefended.

Other benchmarks agree on direction, not magnitude. InjecAgent hijacks a ReAct-prompted GPT-4 in 24% of 1,054 cases, 47% with a hacking prompt, and 7.1% after fine-tuning. Agent Security Bench reports a highest average attack success of 84.30% for a mixed attack across 13 backbones, while its best indirect-injection defense leaves 24.96% from a 27.55% baseline. These are different attack sets and different denominators; the honest comparison is order of magnitude, not rank.

Design-level defenses do better by bounding what the agent can do. CaMeL extracts control and data flows from the trusted query, so untrusted data cannot change program flow, and uses capabilities to block unauthorized data flows; it solves 77% of AgentDojo tasks with provable security against 84% undefended, and records 0 successful attacks of 949 for Claude 3.5 Sonnet. The authors' own next section says “No, prompt injection attacks are not fully solved.” FIDES uses information-flow policies and reports 1 successful attack, or 0 excluding two non-attack injection tasks. StruQ reduces manual attacks below 2% but optimization-based attacks still reach 9–58%; SecAlign reports 0% optimization-free and 8% for the strongest optimization attack; Microsoft's spotlighting cuts attack success from above 50% to below 2%; the dual-LLM pattern keeps the planner away from untrusted data entirely.

Shipped controls are weaker than research prototypes and less tested. Anthropic's fix was a single blocked command plus a README warning. Copilot's three runtime layers were bypassed in one attack. Claude Code's sandbox — filesystem isolation plus a network allowlist proxy — was bypassable in every release from v2.0.24 through v2.1.89, about 130 versions over five and a half months; one bypass got CVE-2025-66479, the other was silently fixed. No shipped control in this report has a published post-patch attack success rate.

The defensible control stack is therefore not a detector but a containment policy. Restrict who can trigger the agent, or require maintainer approval before untrusted input reaches a privileged run. Grant only the credentials, tools and service permissions the task needs. Restrict exfiltration channels by sandboxing the network and limiting attacker-visible outputs. Separate analysis from action: a low-privilege agent reports, a trusted process or human decides. Treat the agent's output as untrusted data. Monitor tool calls, credential access and egress.

§7 · Verdict and scenarios

Contain the capability, not the conversation

Prompt injection is not a bug to patch; it is context the agent is designed to process. The defensible goal is to bound what a hijacked agent can do.

The verdict: prevention is not available on the evidence. Every prevention layer in the record — model alignment, prompt framing, blocklists, secret scanning, network firewalls, attack detectors — was bypassed by a payload adapted to the runtime. The strongest research defenses that do hold are architectural: they bound which data can influence control flow and which flows can carry private data out. They buy security with utility and coverage, and they are not deployed at the vendors that were hijacked.

Two operating paths follow. Under containment discipline, an organization treats every agent as a privileged program: it limits who can trigger it, what it can touch, where it can send data, and it logs tool calls. Incidents still happen, but they become contained credential exposures rather than silent takeovers. Under capability race, agents get more tools, more integrations and more secrets because that is what makes them useful, and controls are bolted on after each disclosure. The record's default is the second path: three vendors paid $1,937 in bounties and shipped narrow fixes.

The market does not price the risk. Adoption is real — LangChain's survey of more than 1,300 professionals reports 51% using agents in production and 78% with active plans — but the safety record is thin: the AI Agent Index found only 19.4% of 67 deployed agentic systems disclose a formal safety policy, and fewer than 10% report external safety evaluations. Gartner forecasts that 40% of enterprises will demote or decommission autonomous agents by 2027 because of governance risk — a forecast, not an observation. And the denominator that would let anyone price hijack risk does not exist.

What would falsify the verdict: an independently tested, deployed defense that holds targeted attack success below 5% under adaptive attack across two benchmarks while losing less than 10% of benign utility. No such result exists in this register. The closest are CaMeL's 0 of 949 attacks at a 7-point utility cost, and FIDES' 1 or 0, both on AgentDojo, both research prototypes, both caveated by their authors.

§8 · Falsification triggers

Six readings that would change the verdict

Public evidence leaves most of these unresolved. Instrument them locally; do not fill the global gap with vendor estimates.

These thresholds are proposed control gates or claim tests, not published industry averages. Two are partially measured; four are standing gaps. Revisit them when a benchmark, an incident series or an organization's own telemetry becomes available.

§9 · Entity deep dives

The four stacks that keep getting hijacked

The common stack: untrusted context, a capable agent, and secrets in the same runtime. Expand any row for the record.