ACVERogue and malicious agent events

Advisories › ACVE-2026-0425

ACVE-2026-0425 · Hijack shown in a test · HIGH

Unverified · secondary sources only

WHAT HAPPENED

The agent follows instructions embedded in the PR title, issue body or comments and posts the job's secrets back as a PR or issue comment.

THE SETUP — is yours like this?

Harness
A GitHub Actions job running anthropics/claude-code-security-review or google-github-actions/run-gemini-cli (the GitHub Copilot coding agent was also demonstrated), oddguan.com
Model
The default model of each action: Claude for the security review action, Gemini for the Gemini CLI action (detected), oddguan.com
Goal
Review the pull request for security issues, or triage and respond to the GitHub issue, oddguan.com
Tools
The agent's shell command execution; PR title, issue body and comments interpolated into the prompt; job secrets ANTHROPIC_API_KEY, GEMINI_API_KEY and GITHUB_TOKEN in the environment; PR and issue comments used to post results back, oddguan.com
Approval
The action runs headless with no human in the loop; the agent executes its tools automatically, and the demonstrated jobs set no allowed-tools restriction, oddguan.com

WHAT TO CHANGE

Keep secrets out of agent jobs that untrusted PRs, issues or comments can trigger.

  • Reconfigure .github/workflows: triggers, permissions and secrets of the agent job. The agent treats PR titles, issue bodies and comments as instructions. Owner: operator
  • Reconfigure harness.github-action.allowedTools to no shell access unless the workflow grants it. Recommended: the demonstrated jobs set no allowed-tools restriction, and the agent posted the job's secrets back. Owner: harness-vendor
  • Reconfigure github.actions.untrustedTriggers to maintainer approval before a job with secrets runs on an outside author's PR or issue. Recommended: text from untrusted authors reached jobs holding the secrets. Owner: infra-provider

HARM, REACH AND RECOVERY

Harm
credential-theft
Reach
The CI job's secrets and tokens, oddguan.com (API keys)
Condition
When the action runs on pull requests or issues from untrusted authors, oddguan.com
Evidence and responses
Demonstrated · researcher report

SOURCES

ARTICLE

Technical details

Text in a PR title, issue comment or hidden HTML comment hijacks an AI agent in GitHub Actions into leaking the job's secrets when it runs on pull requests or issues from untrusted authors.

Severity
HIGH · harm and reach
Status
Unverified
Kind
Hijack shown in a test
Modified
2026-09-25
Aliases
No CVE assigned — No CVE was assigned; the write-up reports bounties from Anthropic, Google and GitHub but no identifier.
CVE boundary
user-configured
Affected
  • GitHub Actions: anthropics/claude-code-security-review — all versions
  • GitHub Actions: google-github-actions/run-gemini-cli — all versions
Harness/product
anthropics/claude-code-security-review + google-github-actions/run-gemini-cli
Classes
prompt-injection-to-tool; credential-exposure; data-exfiltration; CWE-1427
Taxonomy
ASI: ASI01; ASI: ASI03; ATLAS: AML.T0093; ATLAS: AML.T0051.001; ATLAS: AML.T0086
First reported
2026-04-15 — Aonan Guan
Input controlled by
content-author
Divergence
goal-hijacked
Licence
CC-BY-4.0 advisories; MIT code

Reproducibility: partial (model availability not checked (no registry reference); trigger not published)

Claims

Confirmed means the statement matches the cited primary source. Nothing on this page has been reproduced.

Claims on this page have not been checked against primary sources.

Description

What

Aonan Guan with Zhengyu Liu and Gavin Zhong (2026-04-15) demonstrated it against Claude Code Security Review (anthropics/claude-code-security-review, via the PR title, leaking ANTHROPIC_API_KEY and GITHUB_TOKEN), Gemini CLI Action (google-github-actions/run-gemini-cli, via issue comments, leaking GEMINI_API_KEY) and the GitHub Copilot coding agent (via HTML comments in an issue body). Stolen values come back through PR or issue comments. Per the write-up, Anthropic's triage scored its case CVSS 9.3, then 9.4, then None; GitHub called it a known architectural limitation.

Detection

acve lock cannot see CI workflows, so the matcher cannot fire on a developer machine: review .github/workflows by hand.

Fix

Do not give agent jobs triggered by untrusted input any secret beyond what the task needs; require maintainer approval before they run.

Configuration

The rule ACVE's audit tool uses to recognise this configuration. The tool is not public yet.

harness.id in ["claude-code-security-review","run-gemini-cli"]

Report a problemJSON