Topic starter
02/08/2026 11:41 am
TL;DR: A CVSS 10.0 remote code execution flaw in Google Gemini CLI let external attackers trigger host-level commands through trusted workspace content in headless CI/CD runs, turning AI-assisted pipelines into supply-chain attack paths, according to Novee. The issue shows that agentic security failures now often sit at the boundary between configuration trust, execution privileges, and pipeline governance.
Editorial analysis by NHI Mgmt Group, based on content published by Novee: “A CVSS 10.0 in Gemini CLI: How Agentic Workflows Are Reshaping Supply Chain Risk”.
Key questions
Q: What fails when an AI agent trusts repository content inside CI/CD?
A: The failure is that untrusted workspace content can be treated as configuration before sandboxing or human review, turning a normal build step into host command execution.
Q: Why do agentic workflows increase supply-chain risk in build pipelines?
A: They increase risk because they can act with the same execution authority as trusted automation while still being influenced by external content.
Q: What signs show that CI/CD agent trust boundaries are too loose?
A: Look for agents that auto-load workspace configuration, runners with broad token scope, and pipelines where pull request content can affect execution before validation.
Practitioner guidance
- Constrain agent startup trust decisions Require explicit approval before any agent loads repository-supplied configuration, especially in non-interactive runners that can execute host commands.
- Reduce runner privilege and token scope Limit CI/CD runner identities to the smallest access set needed for each workflow so command execution cannot reach broad secrets or deployment rights.
- Separate untrusted workspace content from execution paths Treat pull request content, generated files, and repository configuration as untrusted until validation has completed outside the privileged runner context.
Bottom line: The incident shows that AI-assisted build systems can fail through unsafe trust in workspace content, not just through model-level prompt attacks.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:53 pm
Agentic CI/CD trust is now a supply-chain control problem: the core weakness is not that AI tools exist in the pipeline, but that they inherit execution authority from the runner and then trust workspace content too early. That changes the meaning of secure build governance because the control boundary moves from code review alone to the agent startup path, the runner identity, and the trust decision itself. Practitioners should treat agent bootstrapping as a privileged control point.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- 59% of compromised machines in a major 2025 supply chain attack were CI/CD runners rather than personal workstations, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How should teams govern AI systems that act like privileged insiders?
A: Treat AI systems as governed actors with explicit access scope, strong logging, and containment boundaries. If an AI can influence data or actions at speed, traditional review cycles are too slow to provide meaningful oversight. The control question becomes what it can access and what it can do.
👉 Read our full editorial: Gemini CLI RCE shows how agentic workflows expand supply-chain risk