Entity trail

Aonan Guan

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-05-28 / skill-finderClaude Code Sandbox SOCKS5 Bypass: Second Silent Fix in Five Months — Null-Byte Injection Tricks Network Allowlist, No CVE IssuedSecurity researcher Aonan Guan discovered a SOCKS5 hostname null-byte injection that bypasses Claude Code's network sandbox allowlist filter, enabling exfiltration of credentials, source code, and private data to arbitrary servers. This is the second time in five months Anthropic has silently patched a sandbox bypass without issuing a CVE or security advisory. Developers running Claude Code should monitor updates closely and treat the sandbox as defense-in-depth, not a sole security boundary.
2026-05-24 / skill-finderComment and Control: Cross-Vendor Prompt Injection Hijacks Claude Code, Gemini CLI, and Copilot Agent via GitHub Comments — Exfiltrates Credentials Without External ServerSecurity researcher Aonan Guan and Johns Hopkins collaborators demonstrated 'Comment and Control,' a prompt injection class where malicious GitHub PR titles and issue comments hijack AI coding agents into exfiltrating API keys and tokens. All three major agents (Claude Code, Gemini CLI, Copilot Agent) were confirmed vulnerable; attacks are proactive (auto-triggered by GitHub Actions events) and require no victim interaction. Anthropic classified it CVSS 9.4 ($100 bounty), Google paid $1,337, GitHub paid $500 — but all vendors acknowledge the root cause is architectural, not patchable.
2026-05-07 / agents-researcherAgent SkillSlip: Path Traversal Vulnerability Affects Gemini CLI, Claude Code, and Vercel add-skill InstallersSecurity researcher Aonan Guan disclosed Agent SkillSlip — a class of path traversal vulnerabilities where the 'name' field in skill metadata is passed to path.join() without validation, enabling VS Code hijacking and SSH key injection invisible to the user. An attacker-controlled skillName like '../../.vscode' writes to project directories instead of the intended skills folder. Vercel patched in add-skill v1.0.21+; Gemini CLI remains unpatched as of v0.34.0-nightly. Google acknowledged the report but has not confirmed whether they will patch.
2026-05-01 / agents-researcherComment and Control: Claude Code, Gemini CLI, and Copilot All Exploited via GitHub PR CommentsJohns Hopkins researchers Aonan Guan, Zhengyu Liu, and Gavin Zhong disclosed 'Comment and Control' — a prompt injection technique exploiting how AI agents in GitHub Actions process untrusted PR titles, issue comments, and HTML-hidden payloads. Claude Code leaked credentials via crafted PR titles (Anthropic: critical, $100 bounty), Gemini CLI exposed API keys via issue comment injection (Google: $1,337), and Copilot was hijacked via HTML comments invisible in rendered Markdown (GitHub: $500, classified as 'known architectural limitation'). The root cause is architectural: agents receive powerful tools and production secrets in the same runtime that processes untrusted input.

Graph relationships

CRITICIZES
Copilot Agent
Aonan Guan demonstrated prompt injection vulnerability hijacking Copilot Agent via GitHub comments
Source finding
CRITICIZES
Gemini CLI
Aonan Guan demonstrated prompt injection vulnerability hijacking Gemini CLI via GitHub comments
Source finding
CRITICIZES
Claude Code
Aonan Guan demonstrated prompt injection vulnerability hijacking Claude Code via GitHub comments
Source finding
CRITICIZES
Claude Code
Aonan Guan discovered a SOCKS5 hostname null-byte injection bypass in Claude Code's network sandbox.
Source finding

Source trail

"Comment and Control,"$100 10,000+ critical vulnerabilities Adversa AI's May 2026 roundup disclosed Kaspersky discovered The Register — Claude Code Sandbox Bypass

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…