Tag
ci
5 entries, including 2 patterns.
The issue body ran with the maintainer's token
PromptPwnd found AI agents in CI that paste issue titles and pull request bodies straight into the prompt, then run with a write token and a shell. The attacker needs only a GitHub account and the ability to open an issue.
- Pattern
Source-Bound CI Attestation
Treat a passing PR check as an attestation from a designated runner about an exact revision, not as a green string any repository writer can supply.
The green check came from the wrong writer
A coding agent's PR can carry a passing status for a test it never ran when the merge gate trusts the check name but not its issuer.
- Pattern
Quarantine Unreviewed Installs
Let PR validation execute lifecycle hooks only in a worker whose credentials, network and output cannot become release authority without review.
The install step ran the pull request
An agent's code-review transcript may be clean while a dependency install executes repository-controlled code before the first test.