Three AI coding agents leaked secrets through a single prompt injection. One vendor's system card predicted it

Researchers at Johns Hopkins and collaborators showed that a single malicious GitHub pull request prompt could trick Anthropic’s Claude Code Security Review, Google’s Gemini CLI Action, and GitHub’s Copilot Agent into exposing secrets, including an API key.

The finding highlights a gap between model documentation and real-world runtime/workflow protections: prompt injection can still break AI coding agent safeguards.

All three vendors reportedly issued quiet patches after the issue was demonstrated.

The case is a warning for repos that give AI agents access to secrets or sensitive workflows.