When Untrusted Text Becomes Operational Authority: Why Agentic Coding Tools Are Unsafe Without a Governance Substrate

On April 15–16, 2026, security researcher Aonan Guan and collaborators at Johns Hopkins University disclosed a cross‑vendor prompt injection attack class — “Comment and Control” — demonstrating that Claude Code Security Review, Google Gemini CLI Action, and GitHub Copilot Agent could each be hijacked via standard GitHub content such as pull request titles, issue bodies, and comments. Credentials including ANTHROPIC_API_KEY, GEMINI_API_KEY, and GITHUB_TOKEN were exfiltrated back through GitHub itself, requiring no external infrastructure. Anthropic classified the Claude Code vulnerability CVSS 9.4 Critical, and all three vendors confirmed the findings. This paper argues that Comment and Control is not merely a collection of vulnerabilities but a predictable consequence of an architecture that collapses meaning and authority into the same channel. The structural flaw is not limited to specific implementations or access patterns; it arises wherever agentic systems consume ungoverned instruction surfaces as both context and control. The analysis distinguishes this failure mode from classic prompt injection and articulates requirements for an instruction‑and‑execution architecture that can withstand Comment‑and‑Control‑class attacks.