PromptPwnd: Prompt Injection Vulnerabilities in GitHub Actions Using AI Agents (www.aikido.dev)

Aikido Security has revealed a new class of vulnerabilities, termed PromptPwnd, affecting GitHub Actions and GitLab CI/CD pipelines that utilize AI agents like Gemini CLI, Claude Code, and OpenAI Codex. The vulnerabilities arise when untrusted user input is injected into AI prompts, allowing the AI to execute privileged actions, potentially leading to leaks of sensitive information or unauthorized modifications of workflows. This discovery impacts at least five Fortune 500 companies, with indications that many more may be affected, highlighting a critical risk in the software supply chain as organizations increasingly integrate AI into their development processes. The significance of this vulnerability lies in its confirmation as a practical exploit for prompt injection in real-world CI/CD environments, as demonstrated by Aikido's successful testing against Google’s Gemini CLI, which was quickly patched. The attack vector exploits the AI's ability to interpret malicious prompts as instructions, allowing for unauthorized actions like editing issues or leaking tokens. Aikido has open-sourced rules for detection, urging organizations to restrict AI tool access and carefully sanitize inputs to safeguard against this emerging threat in automated workflows.