GitInject Framework Exposes Prompt Injection Vulnerabilities in AI-Powered CI/CD Pipelines
A new open-source framework named GitInject has revealed significant prompt injection vulnerabilities in AI agents embedded within continuous integration and continuous delivery (CI/CD) workflows. These AI agents are increasingly used to autonomously review pull requests, triage issues, and maintain codebases. GitInject evaluates these vulnerabilities in live GitHub Actions workflows, unlike simulated benchmarks, by provisioning ephemeral repositories and executing actual workflows. This approach exposes real-world platform semantics, including sandbox constraints, credential handling, and permission boundaries. The framework tested eleven attack scenarios across five workflows from four AI providers, finding that every provider was susceptible to at least one high-severity attack. The most critical vulnerabilities were structural, allowing attacker-controlled configuration files from unmerged contributions to be loaded as operator-level instructions, potentially exposing credentials or corrupting review j...
