[BUG] Outbound bot @-mentions in GitHub comments posted from claude.ai/code remote sessions are defanged, breaking @dependabot / @coderabbitai command flows
Status Open
Maintainer reply None cached
Workaround ✓ Mentioned in description ↑
Activity 0 comments · opened Aug 17, 2026
In a claude.ai/code remote session (2026-08-12), a PR comment posted via the session's GitHub integration containing @dependabot rebase arrived defanged as ·@·d·ependabot r·ebase (separator characters inserted). Dependabot ignores the defanged form, so @dependabot and @coderabbitai command flows from remote sessions silently no-op.
- Expected: the comment body is posted verbatim, or the defanging is documented with an escape hatch for intentional bot commands.
- Actual: mentions are silently rewritten; the commands no-op with no error.
- Workaround in use: post bot-command comments from local CLI sessions.
- Could not find this behavior in the docs or changelog. If it is an intentional prompt-injection defense, please document it and consider an explicit opt-out.