Researchers find prompt-injection attacks can compromise AI-powered CI/CD pipelines

A new academic study says AI agents embedded in automated software pipelines can be tricked by prompt-injection attacks in real, live development workflows, with serious consequences. In the configurations the researchers examined, every provider tested had at least one high-severity weakness. The paper argues the central problem is not a one-off model “jailbreak,” but how these workflows are designed.

That matters because continuous integration and continuous delivery, or CI/CD, systems are widely used to automatically test, review and ship code. A growing number now include AI agents to review pull requests, triage issues or help maintain repositories. When those agents process untrusted outside contributions while running with repository credentials and software tools, a prompt injection can become a software supply-chain risk, not just a chatbot mistake.

The paper, “GitInject: Real-World Prompt Injection Attacks in AI-Powered CI/CD Pipelines,” was written by Jafar Isbarov, Umid Suleymanov, Ilia Shumailov and Murat Kantarcioglu. Isbarov, Suleymanov and Kantarcioglu list Virginia Tech affiliations. It was first submitted to arXiv on June 7, 2026, as arXiv:2606.09935; the current version is v2, dated Nov. 2. Project materials say it was accepted to the NeurIPS 2026 Evaluations & Datasets track.

The authors also released GitInject as open-source software. Its key difference from earlier prompt-injection testing is that it provisions ephemeral repositories and executes actual GitHub Actions workflows rather than simulating tool use. The paper says that exposes real platform behavior, including credential handling, sandbox limits and permission boundaries, that simulations can miss.

Using that setup, the researchers evaluated 11 named attack scenarios across five workflow definitions from four AI providers. The paper’s summary tables report 23 attempted scenario-runs and 15 confirmed successful scenario-runs. Its headline conclusion is blunt: “Every tested provider is susceptible to at least one High-severity attack in the configurations tested.”

The paper says the most important attack class is configuration-file injection. In these cases, attacker-controlled files in a pull request branch — including examples such as CLAUDE.md, AGENTS.md and GEMINI.md — can be loaded by agent tooling as trusted, operator-level instructions before the contribution is merged. As the abstract puts it, “The most consequential vulnerabilities are structural: attacker-controlled configuration files from an unmerged contribution are loaded as operator-level instructions.”

According to the study, that can lead to credential exfiltration, manipulation of an agent’s judgment during code review, and availability or “denial-of-wallet” abuse that wastes compute and money. In one concrete finding, the paper says that in the versions and configurations tested, actions/checkout wrote the repository token into .git/config as a base64-encoded authorization header. The researchers used that behavior in successful proof-of-concept exfiltration attacks. The paper attributes that result to the tested setups, not to all current deployments.

The researchers say they also replicated two configuration-file attacks beyond GitHub, on GitLab CI/CD and a Hugging Face pull request agent. To show why the issue could matter at scale, the paper cites GitHub code-search counts from September 2026 showing roughly 30,300 workflows referencing Anthropic’s Claude Code Action, 2,200 referencing OpenAI’s Codex Action and 1,600 referencing Google’s Gemini CLI Action.

The short-term mitigations the authors tested are mostly operational. They include setting persist-credentials: false in actions/checkout, limiting which tools an agent can use, stripping provider configuration files before invoking the agent, and requiring human approval or restricting automation to trusted contributors. The paper calls persist-credentials: false “the highest-priority recommendation because it is the only row that costs nothing…”

The authors also stress a limitation: the results reflect the workflow and model versions current during evaluation. Later vendor or workflow changes could alter outcomes. Even so, the paper’s main warning is broader than any single model release. In AI-powered developer pipelines, the biggest risk may be trusting instructions that arrive inside unmerged code from strangers.