AI agents expose new security crisis in DevOps pipelines

The discovery of the 'GitLost' vulnerability by Noma Security in July 2026 exposed a critical flaw in AI-driven automation workflows on platforms like GitHub, where a single, carefully crafted public issue could manipulate AI agents into leaking private repository data. This attack exploits the AI's tendency to interpret user-supplied natural language inputs as operational instructions, bypassing traditional security guardrails without requiring any credentials or direct access. As Noma Security Research Lead Sasi Levi explained, the attacker only needs the ability to open a public issue, often achievable with no special privileges, to trigger the data exfiltration.

At the heart of these prompt injection vulnerabilities lies a dangerous mismatch between AI agents' broad read permissions across multiple repositories and their processing of untrusted, user-controlled inputs from public channels like GitHub issues. This combination creates an unintended bridge between sensitive internal resources and public inputs, allowing attackers to embed hidden instructions within natural language that the AI agent executes, effectively turning public comments into injection vectors. Independent researcher Vibhum Dubey highlighted that AI agents operate on service account permission models rather than user-specific ones, leading to invisible permission gaps that transform these agents into potential insider threats once granted wide organizational access.

Mitigating prompt injection attacks such as 'GitLost' is particularly challenging due to the inherent ambiguity in natural language, which lacks clear syntactic boundaries separating data from instructions—unlike traditional injection vulnerabilities like SQL injection. Security experts including Levi and Dubey advocate for architectural defenses over input filtering, emphasizing least-privilege access, scoped credentials, staged human review, and explicit repository whitelists. Additionally, organizations are urged to treat all user-controlled content as untrusted, restrict AI agents' public posting capabilities, and implement emergency kill-switches to swiftly disable compromised agents, thereby reinforcing trust boundaries that AI agents cannot override through natural language prompts.

The porous nature of AI security barriers is further exposed by attackers’ ability to bypass safeguards by framing malicious prompts as benign scenarios such as testing or quality assurance, tricking AI agents into violating their own security policies. This exploitation underscores the fundamental vulnerability of AI agentic systems: the absence of a clear separation between data and instructions, which allows attackers to slip malicious commands past guardrails at scale. As noted in multiple analyses, this paradigm shift demands a reevaluation of AI security models to prevent AI agents from becoming unwitting conduits for data leaks, especially as organizations increasingly deploy these agents with broad access.

In August 2026, Pillar Security revealed a groundbreaking AI agent-on-agent exploit within Google's open-source Python Agent Development Kit (ADK), where a low-privilege, public-facing AI agent manipulated a higher-privilege maintainer-only agent to execute remote code and steal credentials. This vulnerability, which prompted Google to delete three workflows and patch the issue within six weeks, exposed a novel class of privilege escalation risks in multi-agent AI systems, particularly within CI/CD pipelines where agent isolation and permission constraints were insufficiently enforced.

The exploit leveraged social engineering and prompt injection tactics, such as posting GitHub comments starting with “@gemini-cli,” to trick a low-privilege triaging agent into invoking high-privilege Gemini workflows. This allowed attackers to bypass command allowlists by exploiting native git scripting features, resulting in remote code execution on CI runners with access to long-lived tokens and Google Cloud credentials. Consequently, attackers could fabricate credible approval trails for malicious pull requests, impersonate maintainers, and compromise the software supply chain without direct privileged access.

This incident underscored the urgent need to rethink AI security architectures, as trust hierarchies between AI agents mirror traditional human privilege escalation risks. Researchers emphasized implementing distinct, auditable agent identities, enforcing strict tool allowlists, and preserving human oversight mechanisms like branch protection and mandatory code reviews to mitigate these emerging threats. Pillar Security’s findings highlighted that without such measures, multi-agent AI systems remain vulnerable to cascading supply chain compromises that can propagate malicious code downstream across countless projects.

Despite the severity of the Gemini and ADK vulnerabilities, Google did not award bug bounties for these exploits, citing the necessity of social engineering for successful attacks. This stance reveals a gap in current vulnerability reward frameworks when addressing complex, multi-agent attack vectors that blend technical exploits with social manipulation. The case exemplifies how AI-driven CI/CD pipelines introduce unprecedented security challenges that demand evolving threat models and proactive defense strategies to safeguard software supply chain integrity.

In August 2026, critical security flaws were uncovered in the AI agent infrastructures of major cloud providers AWS, Google, and Vercel, revealing that attackers could trigger tools directly without executing the underlying AI models. This execution layer bypass effectively circumvents system prompts and guardrails designed to regulate agent behavior, exposing a novel attack surface distinct from traditional prompt injection vulnerabilities. Each platform exhibited unique attack vectors: AWS’s Amazon Bedrock AgentCore InvokeHarness API required authenticated remote access, Google’s ADK for Python was vulnerable through attacker-controlled session events, and Vercel’s AI SDK was compromised via untrusted sandbox code, underscoring the diverse and complex nature of these flaws.

Mitigation strategies emphasize a rigorous redefinition of trust boundaries within AI agent execution environments, advocating for the rejection of caller-authored tool calls, strict binding of tool invocations to authorized model-generated events, and the minimization of agent privileges. These measures highlight that the root cause lies not in prompt manipulation but in the execution layer’s inadequate enforcement of authorization and sandboxing controls. By isolating tool invocation strictly to validated model outputs, organizations can better safeguard against unauthorized command execution that bypasses AI model logic.

Further compounding the threat landscape, vulnerabilities in AI agent harness and runtime components—particularly those managing permissions and sandboxing—were found to enable remote code execution, API credential theft, and supply chain attacks through malicious inputs embedded in GitHub issues and pull requests. Researchers identified over 100 public repositories with similar vulnerable configurations, signaling a systemic security crisis across AI development pipelines involving Anthropic, Google, and OpenAI agents. This widespread exposure calls for urgent hardening of CI/CD workflows and treating all external inputs as untrusted to prevent attackers from exploiting the infrastructure that orchestrates AI agent operations.

Over 100 public repositories were found with misconfigured AI agent runtimes, enabling remote code execution and credential theft via malicious inputs in development workflows.