AI-powered agents are increasingly embedded in continuous integration and continuous delivery/deployment (CI/CD) pipelines to autonomously review pull requests (PRs), triage issues, and maintain codebases. These agents ingest untrusted content while operating with elevated repository permissions, making them a natural target for prompt injection attacks with supply chain consequences. We present GitInject, an open-source framework for evaluating prompt injection vulnerabilities in real, live GitHub workflows, a widely deployed instance of CI/CD pipelines. Unlike prior agent security benchmarks that simulate tool calls, GitInject provisions ephemeral repositories and triggers actual workflow runs, so that sandbox constraints, credential handling, and permission boundaries behave exactly as in production. Using GitInject, we study workflow configurations across four AI providers and document eleven named attacks spanning config-file injection, credential exfiltration, judgment manipulation, and availability. We find that all tested providers are susceptible to at least one attack class in their default configuration, and that the most critical vulnerabilities are structural: they arise from how CI/CD infrastructure handles credentials and configuration files, not from any specific model's behavior. For each confirmed attack class, we identify the minimum-cost workflow-level countermeasure and analyze its coverage and limitations. GitInject is released publicly to facilitate further research in this direction.

翻译：人工智能驱动的智能体正日益嵌入持续集成与持续交付/部署（CI/CD）流水线中，用于自主审查拉取请求（PR）、分类问题以及维护代码库。这些智能体在处理不受信任内容的同时，拥有高级仓库权限，使其成为提示注入攻击的自然目标，并带来供应链层面的影响。我们提出GitInject，一个用于评估真实GitHub工作流（CI/CD流水线的广泛部署实例）中提示注入漏洞的开源框架。与先前模拟工具调用的智能体安全基准不同，GitInject配置临时仓库并触发实际工作流运行，使沙箱约束、凭证处理和权限边界的行为完全与生产环境一致。利用GitInject，我们研究了四个AI提供商的工作流配置，并记录了涵盖配置文件注入、凭证窃取、判断操纵和可用性攻击的十一种命名攻击。我们发现所有测试提供商在其默认配置下均至少对一类攻击敏感，而最关键的漏洞具有结构性特征：它们源于CI/CD基础设施处理凭证和配置文件的方式，而非特定模型的行为。针对每个确认的攻击类别，我们确定了最低成本的工作流级对策，并分析了其覆盖范围与局限性。GitInject已公开发布以促进该方向的进一步研究。