Comment and Control exposes a CI trust gap in AI coding agents

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Repello AI's report: Prompt-injection attacks used pull request metadata to manipulate three AI coding agents and exfiltrate credentials.

Why it matters: It matters because CI agents often ingest untrusted developer content while holding tokens, so IAM and NHI teams need stronger input segregation, tool scoping, and secret containment around agent workflows.

Context

Comment and Control is a prompt-injection problem in which attacker-controlled pull request metadata becomes an instruction channel for an AI coding agent. In practice, that means titles, descriptions, issue comments, and even hidden HTML comments can cross a trust boundary if the agent ingests them without segregation.

The governance gap is not the model itself but the workflow design around it: CI agents are being granted context, tools, and credentials as if repository text were trustworthy. That is a classic agentic AI security problem with a direct identity dimension because the agent acts through tokens, API keys, and repository-scoped privileges.

Key questions

Q: What breaks when AI coding agents trust pull request metadata as input?

A: The trust boundary breaks first, then the agent’s tool use becomes attacker-directed. Once titles, descriptions, or comments can shape the prompt, the workflow can leak secrets, alter review outcomes, or create malicious artefacts while still looking like normal CI activity. The core failure is treating untrusted repository text as if it were operational instruction.

Q: Why do prompt-injection attacks on CI agents lead to credential theft?

A: They work because the agent often runs with workflow tokens and environment access that exceed what a reviewer actually needs. If the agent can execute commands, inspect processes, or write files, an attacker can redirect those capabilities toward token disclosure. The vulnerability is the combination of untrusted input and over-privileged execution.

Q: How do security teams know whether an AI coding agent is too permissive?

A: Look at what the agent actually tries to do, not what the prompt says it should do. If observe mode shows reads of credentials, access to production-adjacent paths, or repeated destructive command attempts, the policy boundary is already too wide and needs central enforcement.

Q: Should organisations treat AI coding agents like privileged software identities?

A: Yes. If an AI agent can install code, access secrets, or modify repositories, it is functionally acting as a privileged non-human identity and should be governed that way. That means task-scoped access, explicit boundaries, and monitoring of its downstream actions, especially when it can touch build and release systems.

Technical breakdown

How PR metadata becomes an instruction carrier

AI coding agents in CI usually build a prompt from pull request fields, surrounding files, and workflow context. If the agent does not separate attacker-controlled text from privileged instructions, then title text, body text, and comments can be interpreted as directives rather than data. That is a context-injection failure, not a model hallucination issue. The agent sees a single text stream, so trust is inferred structurally rather than cryptographically. Once that happens, review comments, file edits, and tool calls can all be redirected by the attacker’s content. See the Prompt Injection Guide.

Practical implication: Treat every PR field as untrusted input and block it from sharing a prompt boundary with system instructions or tool directives.

Why HTML comments and delimiter mimicry work

The most effective variants exploit format asymmetry. Humans do not normally see HTML comments in rendered pull requests, but the agent does see the raw text. Likewise, fake trust markers such as "Trusted Content Section" exploit the fact that many agent templates rely on plain-text delimiters instead of cryptographic separation. Once an attacker can mimic the delimiter pattern, the agent may interpret the payload as privileged context. This is why simple keyword filters fail: the attack is based on semantics, formatting, and prompt structure, not on a single banned string.

Practical implication: Strip hidden markup and treat delimiter-like text as hostile before it ever enters the agent context window.

How credential exfiltration follows tool access

The risk becomes practical when the agent has runtime tools and secrets available. A review agent with shell access can run commands, inspect process state, or write files that later leave the runner through normal CI channels. In the disclosed cases, the payloads extracted environment tokens, posted secrets into comments, or wrote encoded credentials to committed files. That shows the real failure mode: the agent is not just reading text, it is executing with the permissions of the workflow. Once tool use is available, prompt injection becomes a credential-access event. See the AI Coding Agents Security Guide.

Practical implication: Minimise tool permissions and keep CI agents away from secrets they do not need to complete the review task.

Threat narrative

Attacker objective: The attacker’s objective is to turn the agent’s own review workflow into a secret-exfiltration channel while preserving the appearance of normal CI activity.

1. Entry occurs when the attacker submits a pull request or issue containing adversarial instructions inside titles, descriptions, or hidden comments.
2. Credential access follows when the AI coding agent ingests that metadata as trusted context and uses its available tools or runtime visibility to reach tokens and environment values.
3. Impact occurs when the agent leaks secrets into comments, public issues, or committed files that leave the repository boundary.

Breaches seen in the wild

• Gemini CLI prompt injection flaw 2025: Tracebit showed a poisoned README could make Gemini CLI run hidden commands and exfiltrate developer secrets; Google fixed it in 0.1.14.
• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Comment and Control is a workflow trust failure, not a model failure. The important control gap is the assumption that pull request metadata can be ingested into an agent context window without strict segregation. Once a CI agent is allowed to interpret attacker-controlled text as both data and instruction, traditional code review boundaries collapse. Practitioners should treat repository text as hostile input wherever an agent has tools or secrets.

The named concept here is context-window trust collapse. That is the point at which a system stops distinguishing between externally supplied content and privileged runtime instructions. The article shows that this collapse can be reproduced across multiple vendors with different payload shapes, which means the weakness sits in the operating pattern, not a single implementation. agentic applications need explicit trust boundaries, not softer prompts.

Credential exposure becomes the real impact once the agent can act with workflow privileges. The disclosure is especially relevant to identity and NHI governance because the agent is effectively an identity-bearing runtime using API keys, tokens, and repository credentials on behalf of the workflow. When those credentials are available to the review agent, prompt injection becomes an identity abuse problem as much as an AI safety problem.

Bug bounty pricing and CVE handling are lagging the threat. A class rated Critical in one vendor’s process, then downgraded or closed without a CVE, shows that organisational response models are still calibrated for traditional vulnerabilities. That leaves practitioners with a governance gap: if the reporting taxonomy cannot accurately classify agent-runtime compromise, the control programme will understate exposure and under-prioritise remediation.

OWASP LLM01 is still the right label, but the operational lesson is broader. The article demonstrates indirect prompt injection through common collaboration surfaces that teams already trust, which means security leaders should widen their review scope beyond chat interfaces and into CI pipelines, repository metadata, and agent toolchains. The practitioner implication is to govern the whole agent execution path, not just the model prompt.

From our research library:

• Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
• Companies are dedicating an average of 32.4% of their security budgets to secrets management and code security, with US organisations leading at 40.8%, according to the State of Secrets in AppSec.
• Read next: AI Coding Agents Security Guide

What this signals

Context-window trust collapse: the practical lesson is that agents fail when hidden or user-supplied repository text shares the same trust plane as system instructions. Security teams should assume that any collaboration surface feeding an agent can become an instruction channel unless it is explicitly sanitised and segmented.

The stronger governance model is identity-first rather than prompt-first. When an agent can use repository tokens, shell access, and outward-facing comments, the control point is not the text generation step but the credential and tool boundary around the agent runtime. That is where review pipelines need policy, logging, and least privilege.

The most durable defence is to narrow what the agent is allowed to touch before inference begins. If the workflow cannot read secrets, cannot execute arbitrary tools, and cannot persist artefacts without a separate approval step, prompt injection loses most of its operational value.

For practitioners

• Harden PR metadata handling Strip or neutralise HTML comments, delimiter-like markers, and other hidden markup before pull request text reaches an agent context window.
• Separate agent context from user content Keep system instructions, repository text, and reviewer guidance in distinct layers so attacker-controlled PR fields cannot masquerade as trusted prompts.
• Reduce token exposure in CI Remove write-capable tokens, environment secrets, and broad repository scopes from agent workflows that only need review or summarisation privileges.
• Test against the documented payload patterns Replay the title-injection, trusted-section spoofing, and HTML-comment variants in a non-production pipeline to verify that the agent fails closed.
• Constrain post-inference tool use Block shell execution, outbound exfiltration paths, and file writes unless the workflow explicitly requires them for the review task.

Key takeaways

• The central problem is not just prompt injection, but the collapse of trust boundaries between repository text and privileged agent instructions.
• The disclosed cases show that AI coding agents can turn ordinary pull request metadata into secret-exfiltration paths when their tool access is too broad.
• The limiting control is identity and tool scoping around the agent runtime, not prompt wording alone.

Related NHI Mgmt Group resources: Prompt Injection Guide · Agentic AI Security Guide · AI Coding Agents Security Guide · OWASP Agentic Applications Top 10

Key terms

• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• Context Trust Boundary: A context trust boundary is the point where information from one system, user, or agent is no longer assumed trustworthy and must be checked before use. In agentic AI and NHI governance, it marks where prompts, memory, credentials, and tool outputs cross into another security domain and require validation, filtering, and policy enforcement.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Agent Runtime: The agent runtime is the execution environment where an AI agent reads data, calls tools, and carries out actions. It matters because the runtime is where identity, policy, and filesystem boundaries either hold or fail. If those boundaries are weak, the agent becomes a high-privilege path into the environment.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It is designed for practitioners who need to align identity controls with modern AI and automation risk.