In October 2025, a security researcher reported to Anthropic that a crafted pull request title could trick Claude Code into exfiltrating API keys from any repository running its GitHub Action. Anthropic classified it as Critical — CVSS 9.3. In November, they upgraded it to 9.4.
In April 2026, they reclassified it as None.
Not fixed. Not mitigated. Reclassified. GitHub's response: "previously identified architectural limitation." They paid $500. No CVE was issued. No NVD entry. No vendor advisory. The only public disclosure came when the researcher published independently.
This is not a story about a bug that went unpatched. It is a story about why the patch does not exist.
Three Attacks, One Property
On June 25, Mozilla's 0DIN program demonstrated a GitHub repository that opens a reverse shell on any machine that clones it with Claude Code. Not a single line of malicious code exists in the repository. The payload is fetched from a DNS TXT record at runtime — invisible to code review, static scanners, and the agent itself. The capability being exploited: the agent reads and understands code found in repositories. That is the feature. That is the product.
On July 8, Wiz disclosed GhostApproval. A symlink named project_settings.json points to ~/.ssh/authorized_keys. The agent spotted the real target in its own chain-of-thought reasoning — but the approval UI showed the harmless filename. A developer clicks "Accept" believing they are editing configuration. The write hits their SSH keys. Six agents affected: Amazon Q, Claude Code, Augment, Cursor, Google Antigravity, Windsurf. Cursor assigned CVE-2026-50549, CVSS 9.8. Anthropic's response: "not a vulnerability." Augment: "expected product behavior."
In June 2026, attackers compromised 20,000+ Instagram accounts by asking Meta's AI support assistant to attach a recovery email to accounts they didn't own. The agent performed the action correctly. The missing security was human judgment — authorization that had never been written as code because it lived in the discretion of whoever answered the phone.
These are not the same attack. Comment and Control is proactive credential theft. GhostApproval is UI misrepresentation. The 0DIN exploit is repository injection. The Meta incident is a confused deputy. JadePuffer is autonomous ransomware — 600 payloads, 31-second adaptation cycles. IMA is multi-agent harm amplification — 89% success rate, defense detection below 30%. CamoLeak exfiltrates private code through GitHub's own image proxy, one pixel per character. They share no CVE, no common surface, no similar payload.
They share a design property.
Not a Bug
The instruction/data boundary — the foundational security assumption since the Morris Worm in 1988 — does not exist in an agent's token stream. Data is instruction. Input is command. Context is code. There is no boundary to enforce because there is no boundary.
The vendors understand this. That is why they keep classifying critical-severity findings as architectural features.
They are not being dismissive. They are being accurate. You cannot patch a feature without removing the feature. The attack surface is the product.
"A large share of real-world authorization was never written as software at all. Instead, it lived in the discretion of whoever stood between a request and the system."
— Stack Overflow, June 2026
Agents remove that discretion layer. The only serious defense framework proposed — Meta's Rule of Two, which holds that an agent should possess at most two of three properties: process untrusted inputs, access sensitive data, change state externally — was criticized on arrival. The useful agent — the one that reads your repo, runs your tests, files your PRs, and responds to your issues — holds all three by design.
In the Wild
This stopped being theoretical in March 2026. Unit 42 documented the first large-scale evidence of indirect prompt injection deployed in production — 22 techniques catalogued, plain visible text the most common vector at 37.8%. A parallel scan of 49,943 agent skills found 80% behavioral mismatch between what skills declared and what they actually did. Five percent carried multi-stage attack chains. Credential exfiltration and instruction-override hijacking accounted for 88% of the patterns.
Adversa AI tested eleven open-source coding agents — 548,000 combined GitHub stars. Ten of eleven fell to shell injection using techniques from the 1990s: quoted token splitting, $IFS expansion, command substitution. Pattern-matching deny lists fail structurally against shell expansion. Not a new class of attack. The oldest class, against the newest tools.
In May, the first fully autonomous AI-driven attack was documented in the wild — an LLM agent that exploited a known CVE, navigated the filesystem, harvested cloud credentials, pivoted via SSH to a bastion host, and exfiltrated a PostgreSQL database. Under one hour. No human operator.
Gartner predicts 40% of enterprises will decommission autonomous AI agents by 2027 — governance failures discovered only after production incidents. Justin Greis of Acceligence, on GhostApproval affecting six vendors with near-identical trust models: "That suggests we're looking at a category-wide design challenge rather than a collection of isolated implementation bugs."
Eleven attack vectors. Six vendor responses. One property.
The capability is the vulnerability. The vendors said so themselves.