무슨 일이 있었나
Aikido Security's Rein Daelman disclosed 'PromptPwnd', a new class of GitHub Actions vulnerability where untrusted data (e.g. a commit message or issue body) is used inside prompts for AI agents in CI/CD. Because the runner exposes secrets and a write-capable token, the injected instructions let the agent leak GITHUB_TOKEN/cloud/API keys or perform privileged GitHub actions. Daelman demonstrated a supply-chain compromise against Google's Gemini CLI repo by exfiltrating the Gemini API key and GitHub token; Google patched the Gemini CLI workflow after the August disclosure.
왜 중요한가
AI coding and review agents are now common privileged actors in CI. This turns the public issue/PR tracker of a repository into a remote attack surface that can silently release repository and provider credentials, and be chained into supply-chain compromise of downstream consumers — without a CVE and often without detection.
공격 경로
Untrusted user input (issue body, PR description, commit message) is inserted into the LLM prompt inside a CI workflow. The agent treats attacker text as instructions and, because it runs with the workflow's GITHUB_TOKEN and provider credentials, can use its built-in tools (e.g. gh issue edit) to leak secrets, post public comments containing credentials, or modify the workflow.
영향받는 시스템
GitHub Actions / GitLab CI workflows that run AI agents and interpolate untrusted github.event.* fields into agent prompts (Gemini CLI, Claude Code Actions, OpenAI Codex, GitHub AI Inference, and similar agent actions)
완화 방안
Never interpolate untrusted github.event fields into prompt strings (use environment variables / structured inputs instead); restrict which tools the agent can call; scope the GITHUB_TOKEN to minimum permissions; treat AI output as untrusted and gate privileged actions. Scan workflows with Aikido's open-source Opengrep rules or equivalent.