EE
FR Contact

PromptPwnd: issue text can hijack AI agents in GitHub Actions to leak repository secrets

Proof of concept Manipulation Severity 3 significant Confirmed 92% EU

Aikido Security showed that GitHub Actions and GitLab CI/CD workflows that insert untrusted issue, pull-request or commit text into prompts for AI agents holding privileged tokens can be hijacked by prompt injection. In a proof of concept against the issue-triage workflow of Google's own gemini-cli repository, run on a private fork with test credentials, a malicious issue made the Gemini agent run gh issue edit and write tokens into the issue body. Aikido said Google patched it within four days and that at least five Fortune 500 companies were affected by the pattern.

Aikido said some vulnerable workflows can be triggered by any external user who files an issue. It warned that Claude Code Actions and OpenAI Codex become exposed when their default protections, such as running only for users with write permission, are disabled, and released open-source Opengrep rules to detect the pattern.

What would have stopped it

Keep untrusted issue and PR text out of prompts for CI agents, and give those agents read-only, minimal tokens.

Guardrails

3 of 8 failed
  1. G1 Least privilege Failed Agents held high-privilege repository and cloud tokens while processing untrusted issue text.
  2. G2 Human confirmation Failed Workflows ran the agents’ privileged tool calls automatically, with no human review.
  3. G3 Isolation Not assessed Was the agent separated from production systems and the outside world?
  4. G4 Instruction integrity Failed Agent followed instructions hidden in a malicious issue.
  5. G5 Truthfulness Not assessed Did it accurately report what it knew and what it did?
  6. G6 Limits Not assessed Was there a cap on rate, spend, volume or scale?
  7. G7 Oversight Not assessed Could a responsible human see what it was doing and stop it in time?
  8. G8 Recovery Not assessed Could the damage be undone?

Sources

1 primary, 1 press, 1 specialist
  1. PromptPwnd: Prompt Injection Vulnerabilities in GitHub Actions Using AI Agents Aikido Security, 4 Dec 2025
    “Google’s own Gemini CLI repository was affected by this vulnerability pattern, and Google patched it within four days of Aikido’s responsible disclosure.”
    Primary Quote checked Archived copy
  2. AI Agents Create Critical Supply Chain Risk in GitHub Actions eSecurity Planet, 4 Dec 2025
    “At least five Fortune 500 companies have been affected so far, and indicators suggest many more may unknowingly be exposed.”
    Specialist Quote checked Archived copy
  3. AI in CI/CD pipelines can be tricked into behaving badly CSO Online, 5 Dec 2025
    “Aikido Security said that Google had patched the issue in Gemini CLI upon being informed; Google did not immediately respond to a request for information about this.”
    Press Quote checked Archived copy

Confidence 92% comes from these sources alone. How we score

History

  1. 15 Oct 2026Entered in the register with 3 sources

Similar failures

All incidents
  1. EEAIR-2026-017 May 2026 Morse-code prompt makes Grok instruct Bankrbot to transfer 3 billion DRB tokens to an attacker Grok and Bankrbot, xAI and Bankr 84%
  2. EEAIR-2026-014 May 2026 Meta AI support chatbot is tricked into handing attackers control of Instagram accounts Meta AI support assistant 67%
  3. EEAIR-2026-005 Feb 2026 Prompt injection in Cline's Claude issue-triage bot leads to an unauthorised npm release Claude Code GitHub Action, Anthropic 95%