Topic starter
12/06/2026 9:19 pm
TL;DR: A critical prompt injection flaw in Google’s AI-powered GitHub workflow let an external attacker exfiltrate workflow secrets, pivot through repository tokens, and reach full supply-chain compromise across gemini-cli and at least eight other Google repositories, according to Pillar Security. The breach shows that prompt hardening alone does not contain agentic CI/CD risk.
Editorial analysis by NHI Mgmt Group, based on content published by Pillar Security: “My Agentic Trust Issues: From Prompt Injection to Supply-Chain Compromise on gemini-cli”.
By the numbers:
- Pillar Security identified a CVSS 10 critical vulnerability in Google’s AI powered GitHub workflows.
Key questions
Q: What breaks when an AI triage agent can read public issues and reach repository secrets?
A: The trust boundary breaks immediately.
Q: Why does CI/CD prompt injection create a supply-chain risk instead of a local workflow issue?
A: Because the compromise rarely ends at the first secret.
Q: What are the signs that a non-human identity in CI/CD is too permissive?
A: Look for agents that can read filesystem state, trigger other workflows, or access both private data and external destinations in the same job.
Practitioner guidance
- Map every untrusted-input trigger Inventory issue, pull request, comment, and scheduled workflows that can activate an AI agent, then identify which of those runs can reach private data and external network calls.
- Disable credential persistence in checkout Set persist-credentials: false wherever a workflow processes untrusted content so repository credentials are not written into .git/config on the runner.
- Remove the lethal trifecta Break the combination of private data access, untrusted content exposure, and external communication in the same workflow; if all three remain, assume exfiltration is possible.
Bottom line: A public issue was enough to steer an AI triage agent into leaking workflow secrets and starting a supply-chain compromise.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/06/2026 11:18 pm
Prompt injection in agentic CI/CD is a privilege problem before it is a prompt problem. The article shows that the decisive failure was not model quality, but the fact that the agent could act on attacker-controlled text while holding real workflow permissions. Once the agent can read, execute, and communicate, prompt hardening alone is not a security boundary. Practitioners should treat untrusted-input triggers as identity events with blast-radius implications.
A few things that frame the scale:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to the Ultimate Guide to NHIs.
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How should organisations govern AI coding agents in GitHub Actions?
A: Give them the minimum repository and secret access needed, add runtime monitoring for network and process activity, and tightly control external dependencies they can fetch during execution. The right model is layered control: authentication, task scope, egress limits, and evidence of behaviour after the job begins.
👉 Read our full editorial: Prompt injection in gemini-cli exposed supply chain compromise