Security researchers have uncovered a new class of vulnerabilities affecting AI agents integrated into GitHub Actions and GitLab CI/CD pipelines. The attack, dubbed “PromptPwnd,” demonstrates that prompt injection can directly compromise CI/CD workflows, turning automation tools into attack vectors.

The Attack Pattern

The vulnerability follows a predictable pattern that appears across multiple AI-powered CI/CD integrations:

1. Untrusted input reaches the prompt: Issue bodies, PR descriptions, or commit messages are embedded directly into AI prompts
2. AI interprets malicious text as instructions: The model can’t distinguish between data and commands
3. Agent executes privileged tools: The AI uses available tools like gh issue edit or shell commands
4. Secrets are exfiltrated: High-privilege tokens are leaked through issue titles, comments, or other public channels

Affected AI Agents

The research identified four major AI agents vulnerable to this pattern:

The Proof of Concept

Here’s the actual payload used to compromise Google’s Gemini CLI repository:

The AI model interpreted the injected block as legitimate instructions and executed:

gh issue edit <ISSUE_ID> --body "<LEAKED TOKENS>"

The leaked tokens appeared publicly in the issue body. This same technique could exfiltrate any secret available to the workflow.

Why This Matters for Agentic Security

This vulnerability pattern perfectly illustrates why AI agents require fundamentally different security controls than traditional applications:

The Agent Permission Problem: AI agents in CI/CD pipelines often have access to the same tools and secrets as the workflows they automate. When you give an agent gh issue edit capabilities plus access to GITHUB_TOKEN, you’ve created a potential exfiltration path.

Indirect Prompt Injection at Scale: The attack surface isn’t limited to direct user input. AI agents that read issues, PRs, and comments are exposed to indirect prompt injection from any contributor or even external users filing issues.

Tool Use Amplifies Risk: Unlike a simple chatbot, agentic systems can take actions. The combination of prompt injection + tool access + high-privilege secrets creates a reliable exploitation path.

Are You Vulnerable?

Your CI/CD workflows are at risk if they:

• Use AI agents that process user-controlled content (issues, PRs, commits)
• Inject untrusted input directly into prompts using ${{ github.event.issue.body }} or similar
• Expose agents to high-privilege secrets (GITHUB_TOKEN with write access, cloud credentials)
• Grant agents tools that can write to issues, PRs, or execute shell commands
• Allow external users to trigger AI-powered workflows

The Bigger Picture

This research confirms what we’ve been warning about: as organizations rush to integrate AI agents into their development workflows, they’re creating new attack surfaces that traditional security tools don’t detect.

The pattern isn’t unique to CI/CD:

• Customer support agents that read emails can be poisoned by malicious tickets
• Code review agents can be manipulated by adversarial pull requests
• Documentation agents can be hijacked through poisoned source files
• Any agent with tool access is a potential privilege escalation vector

The solution isn’t to avoid AI agents - it’s to build security controls that understand how agents think and act. Prompt injection detection, tool use monitoring, and output validation need to be first-class security requirements, not afterthoughts.

---

For more on agentic security threats, see our OWASP Top 10 for Agentic AI coverage.