Over the past year the CI/CD pipeline stopped being plumbing and became the prize. It holds tokens, cloud keys and publish rights, and now it often holds an AI agent too, one that reads text anyone can write. The class of attacks where untrusted input reaches that agent, or the pipeline’s secrets, is called CI injection (clinejection). Here are four real breaches from 2025 and what agentpipe and agentpipe SaaS would have caught before an attacker did.
What CI injection is, in plain terms
A workflow triggers on an issue or a pull request. It drops the issue title straight into an AI agent’s prompt. The job holds an npm token and publish rights. Now anyone who opens an issue is handing instructions to a process that can publish your package or leak your keys. No one clicked anything. That is clinejection: an untrusted trigger wired, in one chain, to a secret.
The important part: protection against CI injection does not start at runtime, it starts at code review. If you can see that an untrusted trigger and a secret sit on the same chain, you can break the chain before an attacker uses it. That is exactly what the CI/CD security scanner agentpipe does. It traces the link from entry point to impact statically and points at the exact file and line.
Untrusted trigger
An issue or pull request title, a comment, an external package, someone else’s fork. Text that anyone can write.
A step with broad rights
An AI-agent step, or a job that holds tokens, cloud access or write permissions.
Secret or publish
Secret exfiltration in CI, a malicious release, access to private repositories and data.
Breach 1. Amazon Q Developer: a hostile pull request inside the AI agent
July 2025. An attacker opened a pull request against the public repository of the popular Amazon Q Developer extension for VS Code and planted a destructive instruction into the AI agent’s system prompt: wipe the filesystem and delete the user’s cloud resources. The pull request passed review and shipped in a release, and the malicious build reached hundreds of thousands of installs before it was pulled. It is a textbook case of prompt injection in GitHub Actions and the build chain: an outside contributor reached an agent with powerful rights.
Source: reports on the Amazon Q Developer extension incident (VS Code Marketplace), July 2025.
Breach 2. GitHub MCP: a public issue as a command to the agent
In 2025 Invariant Labs demonstrated a live data-theft scenario through GitHub MCP. An attacker opens a public issue with hidden instructions. An AI agent connected to GitHub over MCP, with access to private repositories, reads that issue as a task and dutifully moves private data into a public pull request. It is canonical CI/CD injection: untrusted trigger, agent step, private data leaked. The attacker needs no code exploit, only text in an issue.
Source: Invariant Labs research on prompt injection via GitHub MCP, 2025.
Breach 3. tj-actions/changed-files: secrets in public logs
March 2025, CVE-2025-30066. One of the most popular GitHub Actions, tj-actions/changed-files, was compromised through a tag swap. Malicious code made the runner dump process memory, that is build secrets, straight into public logs. Tens of thousands of repositories were exposed, the ones that pinned the action by a floating tag instead of a fixed commit. It is a pure supply chain attack on CI/CD and mass secret exfiltration in CI.
Source: NVD, CVE-2025-30066; analyses by StepSecurity and Wiz, March 2025.
Breach 4. s1ngularity / Nx: a postinstall that hunted secrets with your own AI
August 2025. Malicious versions of the Nx npm package shipped a postinstall script that harvested GitHub tokens, npm tokens, SSH keys and crypto wallets straight off developer machines and CI. What stood out: the script used locally installed AI CLIs to find files with secrets automatically. It showed a new edge of the problem, where the agent and its config on the build machine become part of the supply chain attack themselves.
Source: analyses of the s1ngularity / Nx incident (Wiz, StepSecurity, Socket), August 2025.
What agentpipe and agentpipe SaaS actually check
It is one engine in two forms. The free agentpipe (CLI and GitHub Action, open source, MIT) gives you protection against CI injection right inside your pipeline: run it locally in two minutes or add one workflow file, and on every pull request a bot leaves a single comment with the chains it found. agentpipe SaaS installs once on your whole GitHub organization, watches every repository without a single workflow file, and collects every finding on one dashboard.
| Scenario | agentpipe (CLI and Action) | agentpipe SaaS |
|---|---|---|
| Finding the clinejection chain on a pull request | yes | yes |
| Third-party action on a floating tag instead of a SHA | yes | yes |
| Secret in scope of a job | yes | yes |
| Checking local agent configs | agentpipe local | on machines |
| One picture across all org repositories | no | yes |
| No workflow files, one-click install | no | yes |
| Policy across the whole fleet and a dashboard | no | yes |
Honest limits
agentpipe reports preconditions, not proof of exploitation. It analyzes GitHub Actions and agent configs statically, does not run your agent, and does not stop prompt injection at the moment of attack. Every report ends with what the scan cannot see, and that is where a real pentest begins. If you need a runtime line, airlock_ai covers it, and honest human approval of actions is handled by countersign. Together it is defense in depth: agentpipe catches the chain early, airlock and countersign back you up at runtime.
How to start in two minutes
Protection against CI injection does not need a week-long rollout. Install the CLI and scan a repository:
pip install agentpipe-scan
agentpipe scan . # check this repo's workflows
agentpipe local # check AI-agent configs on this machineLike it on one repo and want a single dashboard and policy for the whole org? Install agentpipe SaaS, free during beta. AI-agent security in CI/CD starts with seeing the chain before the attacker does. See also our roundup of 10 real AI-agent vulnerabilities of 2025 and the three lines of defense that cover each other’s blind spots.
Frequently asked
What is CI injection (clinejection)?
It is a class of attacks where untrusted input (an issue or pull request title, a comment, an external package) reaches, in one chain, an AI agent or the build’s secrets. The attacker needs no code exploit, only text your pipeline reads.
How is agentpipe different from a linter or a code scanner?
A linter checks workflow syntax or the code. agentpipe traces the whole link: untrusted event, agent step, secret, and points at the exact file and line. It looks for the chain, not one line of config.
Does agentpipe stop prompt injection at the moment of attack?
No. agentpipe works statically and reports preconditions before anything runs, it does not execute your agent. A runtime line is covered by airlock_ai, and honest human approval of actions by countersign.
What does agentpipe SaaS add over the free version?
The engine is the same. agentpipe SaaS installs once on your whole GitHub organization, watches every repository without workflow files, and collects findings on one dashboard with policy across the fleet. The free version (CLI and Action) protects a single repository.
Is it really free?
The CLI and the GitHub Action are free and open source forever (MIT). agentpipe SaaS is free during beta with fair-use limits.