Claude Code, Gemini CLI, GitHub Copilot Agents Vulnerable to Prompt Injection via Comments

Researchers discovered a vulnerability called 'Comment and Control' that affects multiple AI coding assistants, including Claude Code, Gemini CLI, and GitHub Copilot Agents. The attack works by hiding malicious instructions in code comments, which the AI systems then follow as if they were legitimate user requests. This is a type of prompt injection (tricking an AI by hiding instructions in its input) that specifically targets AI tools designed to help developers write code.