The vulnerability involves prompt injection via comments in AI-based tools including Claude Code, Gemini CLI, and GitHub Copilot Agents. An attacker can embed malicious instructions within comments that the AI agents process, potentially altering their intended behavior. The attack method is termed 'Comment and Control' by the researcher who disclosed it. Details on affected versions and remediation are not available in the provided data.

If exploited, this vulnerability could allow an attacker to influence the output or behavior of the affected AI agents by injecting malicious prompts through comments. This may lead to unintended actions or information disclosure depending on the AI agent's role. However, no known exploits in the wild have been reported, and the overall impact is assessed as medium severity.

Patch status is not yet confirmed — check the vendor advisories for current remediation guidance. Until official fixes or mitigations are available, users should exercise caution when processing untrusted comments or inputs in these AI tools. Monitor vendor communications for updates on patches or recommended mitigations.