ACVE-2026-0425

In the wild

demonstrated · news

Description

What

Comment and Control demonstrated that Claude Code Security Review, Gemini CLI Action, and Copilot Coding Agent can be steered by untrusted pull-request titles or issue bodies to disclose CI secrets. The reported CVSS is 9.4, but the research describes a controlled demonstration rather than a confirmed victim campaign.

Which configuration is exposed

The exposed configuration runs a headless coding agent on untrusted PR or issue text while its surface can perform side effects and approval is automatic or absent. The risk is the combination of source content, unattended execution, and access to CI credentials.

How ACVE detects it

ACVE checks the headless feature, coding or tool-calling surface, and auto or never approval. It does not read comments, secrets, workflow tokens, or agent output. Unknown approval or headless state is possible.

Fix

Require approval for side effects, isolate CI credentials, restrict agent tools, and treat PR titles, issue bodies, and comments as attacker-controlled input. Prefer a sandbox with short-lived tokens and no production access.

Grounding needed

The SecurityWeek article should be checked for the three agent products, date, and secret-leak path. The result is demonstrated because no confirmed victim report is cited.

This record is limited to the condition named in the public source: Headless CI agents leak secrets through untrusted comments. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.

Configuration

and
  features["headless"] eq true
  surface in ["coding","tool-calling"]
  approval in ["auto","never"]

Fix

Require approval or isolation for headless agents processing untrusted comments.

• Reconfigure approval to ask. Keep CI side effects behind review.
• Reconfigure features["headless"] to false. Do not run untrusted comment flows unattended.

Validation

No validation entries recorded.

Grounding

No grounding checks recorded.

References

No references recorded.