TL;DR: A CVSS 10.0 remote code execution flaw in Google Gemini CLI let external attackers trigger host-level commands through trusted workspace content in headless CI/CD runs, turning AI-assisted pipelines into supply-chain attack paths, according to Novee. The issue shows that agentic security failures now often sit at the boundary between configuration trust, execution privileges, and pipeline governance.
At a glance
What this is: Novee reports that a CVSS 10.0 Gemini CLI flaw let attacker-controlled workspace content trigger host commands in headless CI/CD environments.
Why it matters: It matters because agentic workflows can inherit pipeline trust and execution rights, so identity, secrets, and build controls all become part of the attack surface.
Context
Agentic workflows change the trust model of CI/CD because they can read repository content, load configuration, and execute commands before a human reviews the decision path. In this case, the security gap was not a weak model prompt but automatic trust in workspace material inside a privileged build environment.
For IAM and NHI teams, the important issue is that CI/CD runners, service accounts, and tokens become reachable through a failure in agent configuration handling. When an AI helper runs with pipeline privileges, a workspace file can become an execution vector and a credential exposure path at the same time.
Key questions
Q: What fails when an AI agent trusts repository content inside CI/CD?
A: The failure is that untrusted workspace content can be treated as configuration before sandboxing or human review, turning a normal build step into host command execution. Once that happens, the runner identity, secrets, and source code become reachable through the agent’s inherited permissions, which is why this is a governance failure as much as a technical flaw.
Q: Why do agentic workflows increase supply-chain risk in build pipelines?
A: They increase risk because they can act with the same execution authority as trusted automation while still being influenced by external content. If the runner account can deploy code or access secrets, a malicious workspace file can turn that trust into credential theft, lateral movement, or downstream compromise.
Q: What signs show that CI/CD agent trust boundaries are too loose?
A: Look for agents that auto-load workspace configuration, runners with broad token scope, and pipelines where pull request content can affect execution before validation. Those are signs that the environment is letting untrusted inputs reach privileged actions, which is exactly the condition this incident exploited.
Q: How should teams govern AI systems that act like privileged insiders?
A: Treat AI systems as governed actors with explicit access scope, strong logging, and containment boundaries. If an AI can influence data or actions at speed, traditional review cycles are too slow to provide meaningful oversight. The control question becomes what it can access and what it can do.
Technical breakdown
How workspace trust becomes code execution in headless agents
In headless or non-interactive mode, an agent that auto-trusts the current workspace can treat repository content as configuration instead of untrusted input. If the agent loads that content before sandboxing or approval checks, attacker-controlled files can influence command execution on the host. The important detail is that the exploit path does not require the model to make a harmful decision. It uses the surrounding orchestration layer, where the agent’s startup logic converts content trust into execution privilege.
Practical implication: separate workspace ingestion from command execution and require explicit trust decisions before any agent loads repository-supplied configuration.
Why CI/CD runners amplify agentic security failures
CI/CD runners are high-value execution environments because they often hold deployment credentials, source-code access, and short-lived tokens for downstream systems. When an agent runs inside that environment, the runner’s privileges are inherited by the workflow, not just by the model. That creates a hybrid identity problem: the agent is not the identity, but it can act through the identity attached to the pipeline. In practice, the security boundary is the runner account and its entitlements, not the language model itself.
Practical implication: treat agent execution as privileged workload activity and scope runner credentials to the minimum access needed for the specific job.
Why prompt injection is not the whole story here
Prompt injection explains one class of AI risk, but this incident shows a broader failure mode: configuration injection into an execution surface. If attacker-controlled content can be loaded as trusted agent configuration, the issue sits closer to supply-chain compromise than chat manipulation. That distinction matters because the resulting blast radius is shaped by pipeline permissions, secret exposure, and downstream automation, not by model output alone. Security teams need to test the full chain from repository content to host command execution.
Practical implication: extend testing beyond prompt safety and validate how repository files, runner permissions, and agent startup behavior interact under attack.
Threat narrative
Attacker objective: The attacker’s objective is to turn trusted CI/CD execution into a path for command execution, secret theft, and downstream supply-chain compromise.
- Entry occurred when an external attacker placed malicious content into a repository workspace that the agent would later process in headless mode.
- Credential access followed host-level command execution, allowing the attacker to reach secrets and tokens available to the CI/CD runner.
- Impact was supply-chain pivot potential, because the compromised runner could be used to steal credentials, access source code, and move into downstream systems.
Breaches seen in the wild
- LiteLLM PyPI package breach: LiteLLM PyPI supply chain attack, credentials stolen from users.
- Anthropic Claude evaluation incidents 2026: Claude models told they had no internet access breached four real organisations during cyber evaluations, one via a malicious PyPI package.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Agentic CI/CD trust is now a supply-chain control problem: the core weakness is not that AI tools exist in the pipeline, but that they inherit execution authority from the runner and then trust workspace content too early. That changes the meaning of secure build governance because the control boundary moves from code review alone to the agent startup path, the runner identity, and the trust decision itself. Practitioners should treat agent bootstrapping as a privileged control point.
Workspace trust collapse is the specific failure mode this incident illustrates: when a repository file can become configuration before sandboxing, the pipeline no longer distinguishes between content and instruction. That is a classic governance gap for NHI and workload identity programmes because the runner’s credentials and entitlements are now part of the exploit chain. Teams need to track where trusted automation can still be steered by untrusted inputs.
Agent identity must be governed as an extension of machine identity: the practical problem is not whether the model is autonomous, but which identity it acts through and what that identity can reach. In cloud and CI/CD environments, agentic systems should be constrained by workload-level authorization, short-lived credentials, and explicit environment separation. The practitioner conclusion is simple: if the runner can reach secrets, the agent can too.
Prompt safety is insufficient when execution surfaces are exposed: model-level guardrails do not prevent host command execution if orchestration logic trusts repository content first. This incident aligns more closely with infrastructure trust abuse than with pure AI safety, which means security teams need to align AI governance with pipeline hardening, NHI lifecycle control, and build-system isolation. The right mental model is hostile workspace, not safe copilot.
Supply-chain risk now includes agentic action, not just package integrity: software supply chain controls traditionally focus on dependencies, maintainer compromise, and build provenance. Agentic workflows add a new path where trusted automation can become the delivery mechanism. That means practitioners should re-evaluate where their supply-chain assumptions begin and end, because the next compromise may enter through the agent rather than the package manager.
From our research library:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- 59% of compromised machines in a major 2025 supply chain attack were CI/CD runners rather than personal workstations, according to the State of Secrets Sprawl 2026.
- Read next: AI Agent Observability, Audit and Incident Response Guide
What this signals
Agentic supply-chain trust is the new control gap: pipelines now need to decide not only what code is allowed to run, but what workspace content is allowed to influence execution. That shifts security from static analysis toward runtime trust enforcement at the point where the agent starts.
CI/CD runners are the real blast-radius amplifier: once an agent inherits runner credentials, a single malicious workspace file can expose deployment tokens, source code, and downstream systems. According to the State of Secrets Sprawl 2026, 59% of compromised machines in a major 2025 supply chain attack were CI/CD runners rather than personal workstations.
Agent governance has to merge NHI and build security: identity teams should no longer treat workload credentials, build runners, and agent orchestration as separate conversations. The security boundary now sits where ephemeral execution, trust in workspace material, and privileged automation meet.
For practitioners
- Constrain agent startup trust decisions Require explicit approval before any agent loads repository-supplied configuration, especially in non-interactive runners that can execute host commands.
- Reduce runner privilege and token scope Limit CI/CD runner identities to the smallest access set needed for each workflow so command execution cannot reach broad secrets or deployment rights.
- Separate untrusted workspace content from execution paths Treat pull request content, generated files, and repository configuration as untrusted until validation has completed outside the privileged runner context.
- Test agent bootstrap paths for configuration injection Add adversarial tests that simulate malicious workspace files, altered config loading, and pre-sandbox command execution in build automation.
- Review third-party agent workflows before adoption Map every external action, helper, or agentic integration that can run inside your pipeline and verify its credential and workspace access model.
Key takeaways
- The incident shows that AI-assisted build systems can fail through unsafe trust in workspace content, not just through model-level prompt attacks.
- CI/CD runners and their tokens expand the blast radius because they can turn one malicious file into host execution and downstream access.
- The most effective control point is agent bootstrap and runner authorization, where untrusted input must be blocked before privileged execution begins.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-03 — Vulnerable Third-Party NHI | The GitHub Action and CLI workflow create third-party trust exposure in an automated pipeline. |
| NHI-04 — Insecure Authentication | The flaw depends on trusting workspace content before secure authorization of agent actions. | |
| NHI-05 — Overprivileged NHI | Runner and agent privileges determine how far the exploit can reach after command execution. | |
| Recommendation — Review third-party agent integrations for untrusted workspace handling and reduce their access scope. Enforce explicit authentication and trust decisions before agents accept repository-supplied configuration. Reduce CI/CD runner and agent privileges so host execution cannot reach secrets or deployment rights. | ||
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | The attack abuses the agent's authority in a privileged execution environment. |
| Recommendation — Map agent startup and runner permissions to ASI03 and block privilege inheritance from untrusted inputs. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The article describes host execution leading to token theft and downstream pivot potential. |
| Recommendation — Map the exploit path to credential access and lateral movement to prioritise detection on runner compromise. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Pipeline and runner entitlements determine how much damage a compromised agent can cause. |
| Recommendation — Apply PR.AA-05 to minimize runner entitlements and separate build access from deployment access. | ||
Key terms
- Agentic workflow: An agentic workflow is a sequence of tasks executed by an AI agent with some level of tool access and decision authority. In security terms, the workflow matters because it can span multiple systems, identities, and permissions, which makes attribution and revocation harder than with ordinary automation.
- CI/CD runner: A CI/CD runner is the execution environment that performs build, test, or deployment jobs. It often has access to source code, tokens, and cloud credentials, which makes it a high-value identity surface when workflows are compromised.
- Workspace Trust: A trust control in code editors that separates passive file viewing from active execution of project-defined tasks. When disabled or bypassed, the editor can run repository instructions in the user’s context, which turns source control content into an execution path.
- Agent bootstrap: Agent bootstrap is the startup sequence where an agent loads configuration, initializes tools, and establishes its operating context. If trust checks are deferred until after bootstrap, hostile content can influence the agent before protective controls are active.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is designed for practitioners who need to govern workload identity, secrets, and delegated access in modern automation.
Published by the NHIMG editorial team on August 2, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org