In 2025-2026, the class of attacks on AI-agents in GitHub Actions is described: the malicious comment in the pull request forced agents - Copilot, Gemini CLI, Claude Code - to drain secrets, including API keys and GITHUB_TOKEN, directly to the public logs workflow. Zero interaction from the maine, zero SAST rules. I replicated this script on an isolated stand with a LangChain agent connected to the GitHub API through repo-scope token - from creating an issue to a malicious CD in the main has passed seconds. Branch Protection did not save: the agent had the right to create PR and wait through automatic approval. Below is the full kill area attack on the agentic AI pypalines in CI/CD, with specific CVE, working payloads and mapping on MITRE ATT&CK.
Business logic of attack: why an AI agent in CI/CD
[Applicable: any organization with AI agents in GitHub Actions / GitLab CI/CD, external vector]
The classic supply chain attack through CI/CD requires either a credential theft or the introduction of a confectionation. Both vectors are serious efforts and time.
The AI agent in the pypaline opens a different path. Attacker does not break the infrastructure - he Talking with her. Indirect prompt injection through public issue is initial access with zero privileges. Any GitHub account can create an issue in a public repository.
The impact is determined by the privileges that the AI agent from workflow inherits:
• GITHUB_TOKENwith write-access - creation of commits, release management, modification of workflow-offIES
• Secrets environments - API keys of cloud providers, packet signature keys, credentials registry for container
• Bash/shell Access - Direct execution of commands in runner-environ environment
According to CSA, if workflow uses a trigger pull_request_target without a clear restriction permissions, GITHUB_TOKEN receives the rights to read the contents of the repository, create a comit and release management. One stolen token from the popular open-source project - supply chain compromise for the entire lifetime of the token. Therefore, attacks on the agent AI paipelines are of interest not only researchers, but also real threat actors.
Kill chain: from public issue to capture AI workflow
The full CI/CD compression chain via LLM is five steps. Each manpate on MITRE AT&CK:
1. Resource Development - T1588.007 (Artificial Intelligence).. The attacker studies the workflow files of the target repository - they are public in .github/workflows/. Determines which AI agents are used, which triggers are active (issues, issue_comment, pull_request), which secrets are available.
2. Initial Access - T1195.002 (Compromise Software Supply Chain).. The attacker creates an issue or PR-compliant with embedded injection payload. The only active action on the part of the attacker.
3. Execution - T1059.006 (Python).. The AI agent processes untrusted input, interprets malicious instructions as a task and executes shell teams through its toolset.
4. Credential Access - T1552.001 (Credentials In Files The agent pulls secrets from the environment, configuration files or runner environment and publishes them in an accessible attacking location - the issue header, PR comments or workflow logs.
5. Defense Evasion - T1685 (Disable or Modify Tools). The attacker can instruct the agent to clean the traces - remove the logs, correct the results of the security review (separately from the scoring pipeline hallucinations described in the OWASP LLM09:2025 section).
Critical Moment: Steps 2-4 Occur Automatically, without any action of the materiale. Workflow is triggering for an event issues, the agent receives the issue body, drives through the LLM and executes instructions. Maintainer will see the result after the clock - when the tokens have already leaked.
Indirect prompt injection in GitHub Actions: attack mechanics
How Untrusted input gets into an agent's program
A typical workflow with an AI agent for automatic triad issues documented by Aikido Security in the PromptPwnd study transmits data from issue directly to the product:
YAML:
env:
ISSUE_TITLE: '${{ github.event.issue.title }}'
ISSUE_BODY: '${{ github.event.issue.body }}'
prompt: |
Analyze this issue:
Title: "${ISSUE_TITLE}"
Body: "${ISSUE_BODY}"
Variable environments protect against Classical command injection (shall expansion), but not protected from prompt injection - the model still receives the attacker-controlled text and interprets it on a par with system instructions. This pattern was found in real workflow Google Gemini CLI, and Google closed the vulnerability in four days after Aikido’s disclosure.
The attacker creates an issue with a harmless header and body containing hidden instructions for LLM. Po OWASP LLM01:2025 (Prompt Injection) - classic indirect prompt injection: malicious instructions are delivered not directly, but through data that LLM processes as part of the regular work. The difference from standalone LLM-applications is fundamental: here the agent has Real Privileges in the infrastructure.
According to Aikido, a typical AI agent in GitHub Actions has access to tools like run_shell_command(gh issue edit) and run_shell_command(gh issue list). If RCE does not pass - you can equip secrets, forcing the agent to change the issue header to the value of the environment with the token environment. The result is in the public domain.
According to CSA and Aikido Security, the functionality of the vector is confirmed against several AI agents in GitHub Actions, including Claude Code, Gemini CLI and Copilot. The researchers sent PR comments with injected instructions – agents honestly interpreted and executed them, revealing secrets through publicly available PR comments or actions logs.
The two properties of GitHub Actions make this vector particularly evil compared to attacks on standalone AI agents. First, workflow automatically triggers on events pull_request, issues and issue_comment without any action of the continenter - the victim does not read, does not click or apprugulate. Secondly, GITHUB_TOKEN without clear restrictions permissions Draws privileges to read the contents of the repository, creating commits and managing releases.
Predictions and limitations
Works if:
• Workflow uses AI agent (Copilot Agent, Gemini CLI, Claude Code, OpenAI Code) for issue/PR processing
• Untrusted input (github.event.issue.body, github.event.pull_request.body, Commitation Messages) is inserted into the product without sanitation
• Agent has access to secrets through environment variables and access to shell-tools
• Workflow triggers automatically on issues, issue_commentor pull_request_target
Does not work if:
• Workflow does not process untrusted input through LLM (deterministic logic)
• AI agent is insulated in sandbox without access to shell and secrets
• Tight permissionsdeclarations with minimal scope
• Input passes through rule-based filtering before hitting the product
CVE and real supply chain incidents
Vulnerabilities of AI pyplines in AI tools
CVE-2025-62222 - GitHub Copilot Chat (CVSS 8.8, HIGH). Command injection in the VS Code CoPilot Chat - an unauthorized attacker executes code over the network. CWE-20 (Improper Input Validation) and CWE-77 (Command Injection) Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - full triad is in jeopardy.
nvd.nist.gov
CVE-2025-65099 - Claude Code (CVSS 7.7, HIGH, CVSS 4.0). To version 1.0.39 could execute code from yarn-plagins of the project before the user took the trust dialog at launch. CWE-94 (Improper Control of Generation of Code) Vector CVSS 4.0: AV:N/AC:L/AT
/PR:N/UI/VC:H/VI:H/VA:H - attack on the network, low complexity, but the user is necessary (launching Claude Code in an untrusted directory in the presence of Yarn 3.0+). Shipped at 1.0.39.
The attacks cover a wide range of targets - from system discover to credential theft and data exfiltration.
CVE-2025-30066 - tj-actions/changed-files (CVSS 8.6, HIGH). CWE-506 (Embedded Malicious Code) More than 23 000 repositories were affected.
CVE-2025-30154 - reviewdog/action-setup (CVSS 8.6, HIGH). CWE-506. Compromise 11 March 2025, 18:42-20:31 UTC. Reviewdog/shallcheck, reviewdog/action/cact/cactive-staticplate, reviewog/action-staticcheck, reviewdog/action-staticcheck, reviewdog/act-as-grep. Added to CISA KEV on March 24, 2025.
According to the CSA, the full chain of attack on tj-actions began a few months before the apparent compromise: according to the analysis of Wiz and Unit 42, the attack was through the compromise of the adjacent project (spotbugs / sonar-findbugs), the operation of the maintainer PAT and the subsequent lateral movement through the review to tj-action. One workflow configuration error - and here's a large-scale supply chain incident.
AI tools as a clear target of attack
According to CSA, the compromise of Nx build system in August 2025 Targeted searched for credentials AI-tools: Claude Code, Gemini CLI, Amazon Q. The attackers used the fact that AI coding tools store authentication tokens in predictive means of the file system. AI tools are already considered threat actors not just as a vector, but as a goal for credential access (T1552.001)
Business logic of attack: why an AI agent in CI/CD
[Applicable: any organization with AI agents in GitHub Actions / GitLab CI/CD, external vector]
The classic supply chain attack through CI/CD requires either a credential theft or the introduction of a confectionation. Both vectors are serious efforts and time.
The AI agent in the pypaline opens a different path. Attacker does not break the infrastructure - he Talking with her. Indirect prompt injection through public issue is initial access with zero privileges. Any GitHub account can create an issue in a public repository.
The impact is determined by the privileges that the AI agent from workflow inherits:
• GITHUB_TOKENwith write-access - creation of commits, release management, modification of workflow-offIES
• Secrets environments - API keys of cloud providers, packet signature keys, credentials registry for container
• Bash/shell Access - Direct execution of commands in runner-environ environment
According to CSA, if workflow uses a trigger pull_request_target without a clear restriction permissions, GITHUB_TOKEN receives the rights to read the contents of the repository, create a comit and release management. One stolen token from the popular open-source project - supply chain compromise for the entire lifetime of the token. Therefore, attacks on the agent AI paipelines are of interest not only researchers, but also real threat actors.
Kill chain: from public issue to capture AI workflow
The full CI/CD compression chain via LLM is five steps. Each manpate on MITRE AT&CK:
1. Resource Development - T1588.007 (Artificial Intelligence).. The attacker studies the workflow files of the target repository - they are public in .github/workflows/. Determines which AI agents are used, which triggers are active (issues, issue_comment, pull_request), which secrets are available.
2. Initial Access - T1195.002 (Compromise Software Supply Chain).. The attacker creates an issue or PR-compliant with embedded injection payload. The only active action on the part of the attacker.
3. Execution - T1059.006 (Python).. The AI agent processes untrusted input, interprets malicious instructions as a task and executes shell teams through its toolset.
4. Credential Access - T1552.001 (Credentials In Files The agent pulls secrets from the environment, configuration files or runner environment and publishes them in an accessible attacking location - the issue header, PR comments or workflow logs.
5. Defense Evasion - T1685 (Disable or Modify Tools). The attacker can instruct the agent to clean the traces - remove the logs, correct the results of the security review (separately from the scoring pipeline hallucinations described in the OWASP LLM09:2025 section).
Critical Moment: Steps 2-4 Occur Automatically, without any action of the materiale. Workflow is triggering for an event issues, the agent receives the issue body, drives through the LLM and executes instructions. Maintainer will see the result after the clock - when the tokens have already leaked.
Indirect prompt injection in GitHub Actions: attack mechanics
How Untrusted input gets into an agent's program
A typical workflow with an AI agent for automatic triad issues documented by Aikido Security in the PromptPwnd study transmits data from issue directly to the product:
YAML:
env:
ISSUE_TITLE: '${{ github.event.issue.title }}'
ISSUE_BODY: '${{ github.event.issue.body }}'
prompt: |
Analyze this issue:
Title: "${ISSUE_TITLE}"
Body: "${ISSUE_BODY}"
Variable environments protect against Classical command injection (shall expansion), but not protected from prompt injection - the model still receives the attacker-controlled text and interprets it on a par with system instructions. This pattern was found in real workflow Google Gemini CLI, and Google closed the vulnerability in four days after Aikido’s disclosure.
The attacker creates an issue with a harmless header and body containing hidden instructions for LLM. Po OWASP LLM01:2025 (Prompt Injection) - classic indirect prompt injection: malicious instructions are delivered not directly, but through data that LLM processes as part of the regular work. The difference from standalone LLM-applications is fundamental: here the agent has Real Privileges in the infrastructure.
According to Aikido, a typical AI agent in GitHub Actions has access to tools like run_shell_command(gh issue edit) and run_shell_command(gh issue list). If RCE does not pass - you can equip secrets, forcing the agent to change the issue header to the value of the environment with the token environment. The result is in the public domain.
According to CSA and Aikido Security, the functionality of the vector is confirmed against several AI agents in GitHub Actions, including Claude Code, Gemini CLI and Copilot. The researchers sent PR comments with injected instructions – agents honestly interpreted and executed them, revealing secrets through publicly available PR comments or actions logs.
The two properties of GitHub Actions make this vector particularly evil compared to attacks on standalone AI agents. First, workflow automatically triggers on events pull_request, issues and issue_comment without any action of the continenter - the victim does not read, does not click or apprugulate. Secondly, GITHUB_TOKEN without clear restrictions permissions Draws privileges to read the contents of the repository, creating commits and managing releases.
Predictions and limitations
Works if:
• Workflow uses AI agent (Copilot Agent, Gemini CLI, Claude Code, OpenAI Code) for issue/PR processing
• Untrusted input (github.event.issue.body, github.event.pull_request.body, Commitation Messages) is inserted into the product without sanitation
• Agent has access to secrets through environment variables and access to shell-tools
• Workflow triggers automatically on issues, issue_commentor pull_request_target
Does not work if:
• Workflow does not process untrusted input through LLM (deterministic logic)
• AI agent is insulated in sandbox without access to shell and secrets
• Tight permissionsdeclarations with minimal scope
• Input passes through rule-based filtering before hitting the product
CVE and real supply chain incidents
Vulnerabilities of AI pyplines in AI tools
CVE-2025-62222 - GitHub Copilot Chat (CVSS 8.8, HIGH). Command injection in the VS Code CoPilot Chat - an unauthorized attacker executes code over the network. CWE-20 (Improper Input Validation) and CWE-77 (Command Injection) Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - full triad is in jeopardy.
NVD - CVE-2025-65099
nvd.nist.gov
/PR:N/UI/VC:H/VI:H/VA:H - attack on the network, low complexity, but the user is necessary (launching Claude Code in an untrusted directory in the presence of Yarn 3.0+). Shipped at 1.0.39.The attacks cover a wide range of targets - from system discover to credential theft and data exfiltration.
CVE-2025-30066 - tj-actions/changed-files (CVSS 8.6, HIGH). CWE-506 (Embedded Malicious Code) More than 23 000 repositories were affected.
CVE-2025-30154 - reviewdog/action-setup (CVSS 8.6, HIGH). CWE-506. Compromise 11 March 2025, 18:42-20:31 UTC. Reviewdog/shallcheck, reviewdog/action/cact/cactive-staticplate, reviewog/action-staticcheck, reviewdog/action-staticcheck, reviewdog/act-as-grep. Added to CISA KEV on March 24, 2025.
According to the CSA, the full chain of attack on tj-actions began a few months before the apparent compromise: according to the analysis of Wiz and Unit 42, the attack was through the compromise of the adjacent project (spotbugs / sonar-findbugs), the operation of the maintainer PAT and the subsequent lateral movement through the review to tj-action. One workflow configuration error - and here's a large-scale supply chain incident.
AI tools as a clear target of attack
According to CSA, the compromise of Nx build system in August 2025 Targeted searched for credentials AI-tools: Claude Code, Gemini CLI, Amazon Q. The attackers used the fact that AI coding tools store authentication tokens in predictive means of the file system. AI tools are already considered threat actors not just as a vector, but as a goal for credential access (T1552.001)
