GitInject: Real-World Prompt Injection Attacks in AI-Powered CI/CD Pipelines

An open-source security framework has identified eleven distinct prompt injection attacks against AI agents embedded in software build-and-deploy pipelines, finding that all four tested AI providers were vulnerable to at least one attack class in their default configurations. [1] The framework, called GitInject, was designed to evaluate vulnerabilities in real GitHub workflows rather than simulated environments. It provisions ephemeral repositories and triggers actual workflow runs so that sandbox constraints, credential handling, and permission boundaries behave exactly as they would in production. [1] The documented attacks span config-file injection, credential exfiltration, judgment manipulation, and availability. [1] The researchers found that the most critical vulnerabilities are structural, arising from how CI/CD infrastructure handles credentials and configuration files, not from any specific model's behavior. [1] For each confirmed attack class, the team identified a minimum-cost workflow-level countermeasure and analyzed its coverage and limitations. [1] The findings arrive as AI-powered agents are increasingly embedded in CI/CD pipelines to autonomously review pull requests, triage issues, and maintain codebases. These agents ingest untrusted content while operating with elevated repository permissions, making them a natural target for prompt injection attacks with supply chain consequences. [1] Broader research underscores the security challenges facing AI development ecosystems. A large-scale empirical study of model-sharing platforms such as Hugging Face, ModelScope, and OpenCSG found widespread reliance on unsafe defaults and uneven security enforcement across platforms. The study documented persistent confusion among developers about the implications of executing remote code during model loading. [3] Separate work on AI-based code generators has identified data poisoning as another threat vector. Because large language models are trained on massive volumes of data collected from publicly available online sources, they become an easy target for attackers who inject malicious samples into training data, potentially causing the models to generate vulnerable code. [6] GitInject has been released publicly to facilitate further research. [1]