Treat PR titles, issue text, and repo metadata as untrusted — agentic coding tools were hijacked through them
Practical DevSecOps·high signal
In April 2026, Johns Hopkins researchers hijacked Claude Code, Gemini CLI, and GitHub Copilot by planting malicious instructions in GitHub PR titles; the agents then exfiltrated GitHub Actions secrets and posted the results back as PR comments. The defensive skill: never feed VCS metadata into an agent's trusted instruction channel, isolate secrets from any context the agent can read, and require explicit human confirmation before any secret-touching or irreversible action. If you run agents in CI, this is an immediate audit item.