Comment and Control prompt injection attacks hijack GitHub AI agents to steal API keys with 95% relevance score

<cite index="51-1,51-4">Vercel disclosed a security incident that started with a compromised OAuth app at Context.ai, escalated through a Vercel employee Google Workspace account, and reached internal systems plus customer environment variables not marked sensitive. The attack did not start at Vercel but started at a third-party AI tool called Context.ai that a Vercel employee happened to use, traveled through a compromised Google Workspace OAuth app.</cite> <cite index="51-29,51-30">The scary part of this incident isn't that Vercel was breached. It is that the initial vector was an AI tool nobody on the Vercel security team had any view into.</cite>

<cite index="12-1,12-2">On April 22, 2026, GitLab released security patch versions 18.11.1, 18.10.4, and 18.9.6 for both Community Edition (CE) and Enterprise Edition (EE), addressing multiple vulnerabilities that could be chained to hijack user sessions, steal tokens, and disrupt GitLab instances.</cite> <cite index="12-3,12-5">GitLab.com is already updated, and GitLab Dedicated customers do not need to take action, but all self‑managed deployments are urged to upgrade immediately. These three issues together significantly raise the risk of account compromise, project tampering, and unauthorized access if left unpatched.</cite>

<cite index="31-3,31-15">The vulnerabilities reported in this Security Bulletin include 31 high-severity vulnerabilities and 7 critical-severity third-party vulnerabilities, which have been fixed in new versions of our products released in the last month.</cite> <cite index="31-17">To fix all the vulnerabilities impacting your product(s), Atlassian recommends patching your instances to the latest version or one of the Fixed Versions for each product below.</cite>

<cite index="5-12,5-13">GitHub is now processing 275 million commits per week. At the current pace, 2026 is on track for roughly 14 billion commits — a 14× explosion in a single year.</cite> <cite index="5-16,5-17">According to The Information, the number of pull requests opened by AI agents surged from roughly 4 million in September 2025 to more than 17 million in March 2026 — more than a 4× increase in six months.</cite> Platform strain from AI-driven usage is forcing GitHub to consider agent-specific rate limits and pricing changes.

<cite index="1-1,1-2,1-3">The new pre-agent-steps frontmatter field lets you run custom GitHub Actions steps before the AI agent starts — great for authentication, environment setup, or any prerequisite work. cache-memory working-tree sanitization — Before each agent run, the working tree is now scanned and cleaned of planted executables and disallowed files from cached memory. This closes a real supply-chain attack vector.</cite> The update also introduces OpenCode engine support and enhanced security measures for agentic workflows.

<cite index="54-4,54-5,54-6">At the last re:Invent, we introduced the concept of frontier agents that work autonomously across multiple steps to achieve outcomes, operating continuously until the job is done. The first two—AWS DevOps Agent and AWS Security Agent—are now generally available after the preview. AWS DevOps Agent helps you run cloud operations—investigating incidents, reducing time to resolution, and preventing issues before they happen.</cite> <cite index="54-7">Customers like United Airlines, Western Governors University, and T-Mobile are already using DevOps Agent to accelerate incident response and simplify operations at scale.</cite>

<cite index="56-1,56-5,56-6,56-7">On April 3, 2026, Microsoft's @azure-devops/mcp npm package was found to have a missing authentication layer on a server handling Azure DevOps work items, repositories, and pipelines. An attacker could access configuration details, API keys, and authentication tokens without valid credentials. CVE-2026-32211 carries a CVSS score of 9.1.</cite> <cite index="56-8">A major enterprise vendor repeating the same 'authentication optional' mistake in April that community servers were criticised for in February is a clear signal about where industry defaults still sit.</cite>