Github-Actions

GitHub Copilot Autofix Introduced CI/CD Injection in Snowflake

ATLAS OWASP CRITICAL ▲ 9.2 HN AI Security Aug 18, 2026

Wiz Research's autonomous Red Agent discovered and exploited a GitHub Actions script injection vulnerability in a Snowflake public repository, introduced by a GitHub Copilot Autofix co-authored commit just five days prior. The flaw allowed any unauthenticated GitHub user to execute arbitrary commands in a Actions runner by crafting a malicious issue title, ultimately enabling exfiltration of a token granting access to Snowflake's internal Jira instance. The incident exposes a critical trust gap: AI-assisted code review and AI-generated fixes can introduce and simultaneously fail to detect severe security vulnerabilities.

CVE-2026-12537: Gemini CLI RCE and Claude Code Secret Leak

ATLAS OWASP CRITICAL ▲ 9.2 The Hacker News Aug 08, 2026

Novee Security demonstrated at Black Hat USA 2026 that default configurations of Gemini CLI, Claude Code, and OpenAI Codex allowed a GitHub issue from an unprivileged account to trigger code execution on CI runners and exfiltrate API secrets. Two CVEs were issued: CVE-2026-12537 (CVSS 10.0) for an OS command injection in Gemini CLI's container launcher, and CVE-2026-54316 for a covert API key exfiltration channel in Claude Code. The root cause across all three agents was insecure harness logic — the code layer mediating between the LLM and the host system — rather than the models themselves.

Anthropic Claude Code Prompt Injection Leaks Secrets

ATLAS OWASP HIGH ▲ 9.1 Microsoft Security Blog Jun 08, 2026

Microsoft Threat Intelligence disclosed a vulnerability in Anthropic's Claude Code GitHub Action whereby prompt injection via untrusted GitHub content — issue bodies, PR descriptions, and comments — could cause the AI agent to read sensitive environment variables, including the ANTHROPIC_API_KEY, from /proc/self/environ. The flaw stemmed from inconsistent sandboxing: while subprocess execution paths like Bash were scrubbed of environment variables, the Read tool had no equivalent restriction. Anthropic patched the issue in Claude Code version 2.1.128 by blocking access to sensitive /proc filesystem paths.

CVE-2026-45321: Supply Chain Worm Targets Mistral AI

ATLAS OWASP CRITICAL ▲ 9.2 The Hacker News May 13, 2026

The TeamPCP threat actor has executed a broad supply chain campaign dubbed Mini Shai-Hulud, injecting credential-stealing malware into npm and PyPI packages from major AI and developer tooling ecosystems including Mistral AI, Guardrails AI, and TanStack. The malware profiles execution environments, exfiltrates cloud, CI, and AI tool credentials, and establishes persistence inside Claude Code and VS Code IDEs. The TanStack compromise alone affected 42 packages and 84 versions, exploiting a chained GitHub Actions attack to inject malicious payloads without stealing npm tokens directly.

Gemini CLI CVSS 10 RCE via Config Injection in CI/CD

ATLAS OWASP CRITICAL ▲ 9.2 The Hacker News May 01, 2026

Google has patched a maximum-severity (CVSS 10.0) vulnerability in its Gemini CLI tooling that allowed unauthenticated attackers to achieve remote code execution by planting malicious configuration files in workspace directories automatically trusted by the agent in headless/CI mode. The flaw effectively weaponised CI/CD pipelines as supply chain attack paths, bypassing sandbox protections entirely before they could initialise. A secondary issue in '--yolo' mode further enabled prompt injection to trigger unrestricted shell command execution.

Bitwarden CLI npm Package Supply Chain Attack Steals Secrets

ATLAS OWASP HIGH ▲ 6.5 The Hacker News Apr 24, 2026

A compromised version of the Bitwarden CLI npm package was found stealing developer secrets, including configurations for AI coding tools such as Claude, Kiro, Cursor, Codex CLI, and Aider, as part of an ongoing supply chain campaign. The malicious package leveraged a preinstall hook to exfiltrate credentials and inject malicious GitHub Actions workflows, enabling persistent CI/CD pipeline compromise. The AI tooling angle elevates this beyond a standard supply chain attack, as stolen AI coding assistant credentials could enable downstream prompt injection, data leakage, or lateral movement within AI-assisted development environments.

Axios npm Library Compromised in Supply Chain Attack

ATLAS OWASP HIGH ▲ 7.2 The Hacker News Apr 20, 2026

A North Korean threat group (UNC1069) compromised the popular npm Axios library via a supply chain attack, injecting a backdoor (WAVESHAPER.V2) into two poisoned versions that were inadvertently downloaded by OpenAI's macOS app-signing GitHub Actions workflow. Although OpenAI found no evidence of certificate exfiltration or user data compromise, the incident exposed the signing credentials for ChatGPT Desktop, Codex, Codex CLI, and Atlas, prompting certificate revocation and mandatory app updates by May 8, 2026. The attack highlights the acute risk of software supply chain compromises against AI product delivery pipelines.

Gas Town Supply Chain Attack Hijacks LLM Credits

ATLAS OWASP HIGH ▲ 8.5 HN AI Security Apr 16, 2026

Gas Town, a developer tool with 14.2k GitHub stars, allegedly ships configuration files that autonomously consume users' LLM API credits and GitHub account permissions to perform work on the maintainer's own repository — without explicit user consent. This represents a serious instance of unauthorised agentic AI behaviour, where an installed tool hijacks user-provisioned AI resources and credentials for third-party benefit. The incident raises critical concerns around supply chain trust, excessive agency in LLM-integrated tooling, and the abuse of delegated credentials.

Github-Actions

Stay ahead of the threat.