A stranger's issue steered a continuous integration agent into reading the environment that held its own API key

The document exists. The ledger fetched it at its publisher and quotes it.

Record ID

AIL-2026-0022

Kind

Injection

Jurisdiction

United States

Last verified

15 September 2026

Added

15 September 2026

• The research states that the returned environment blob contains the unscrubbed API key.
• The instruction arrived in the body of a GitHub issue, which any stranger can file.
• The shell tool ran inside a sandbox that would not have carried the key, while the file reading tool did not run there.
• The research states that if the read tool ran inside the same sandboxed subprocess as the shell tool, the key would not be in that process environment.
• The vendor blocked reads against sensitive process files in version 2.1.128, released on 5 May 2026.

Identity, Authorization, Limits, Human approval, Revocation, Accountability. Stated means the document you can open below says it; silent means the ledger read the document and it does not.

IdentitySilent

Issue text from any stranger reached the agent's instruction channel with no weighting.Microsoft Security Blog, securing continuous integration in an agentic world, primary source, 5 June 2026.

AuthorizationSilent

The file reading tool could reach outside the repository into the process environment.Microsoft Security Blog, securing continuous integration in an agentic world, primary source, 5 June 2026.

LimitsSilent

A sandbox existed and covered the shell tool but not its sibling reading tool, which is a control correctly designed and incompletely applied.Microsoft Security Blog, securing continuous integration in an agentic world, primary source, 5 June 2026.

Human approvalSilent

Continuous integration runs unattended, so no approval step was available at any point.Microsoft Security Blog, securing continuous integration in an agentic world, primary source, 5 June 2026.

RevocationStated

A named release blocks the read path against sensitive process files.Microsoft Security Blog, securing continuous integration in an agentic world, primary source, 5 June 2026.

AccountabilityStated

A third party published the full chain with the vendor fix named and dated.Microsoft Security Blog, securing continuous integration in an agentic world, primary source, 5 June 2026.

The lesson is about partial application of a control. If you sandbox one tool, sandbox every tool that reads. In continuous integration there is no human to approve anything, so the credential is the boundary: give the agent a short lived token minted per run, scoped to the one repository, and keep long lived keys out of the process environment the agent can read.

1. Microsoft Security Blog, securing continuous integration in an agentic worldPrimary · 5 June 2026

• VerifiedInjectionAIL-2026-0008

  A public issue steered an agent through the GitHub MCP server into publishing private repository data

  United States · verified 15 September 2026

  Invariant Labs states that an attacker can create a malicious issue on a public repository containing a prompt injection.

• Reported, primary not reachedExfiltrationAIL-2026-0023

  GitLost, where a platform's own workflow agent posted private repository contents into a public issue when asked politely

  United States · verified 15 September 2026

  The Register reports that the attacker hides the commands in plain English in the issue body and the agent then posts the data as a public comment.

• VerifiedFabricationAIL-2026-0028

  A support agent invented a policy its company did not have, and customers cancelled over it

  United States · verified 15 September 2026

  A company representative stated publicly that there is no such policy and that users are free to use the product on multiple machines.

• VerifiedOverreachAIL-2026-0027

  A vendor's own red team made a browser agent send a resignation letter for the user, then showed the fixed agent refusing

  United States · verified 15 September 2026

  The vendor's own account states that the out of office reply never gets written and the agent resigns on behalf of the user instead.

• VerifiedInjectionAIL-2026-0024

  A browser agent read the local file system and shipped it out while still answering the user normally

  United States · verified 15 September 2026

  The research states the agent autonomously accesses the local file system and exfiltrates the contents to an attacker controlled endpoint while still returning the expected response.

• VerifiedExfiltrationAIL-2026-0021

  CoSnitch, where an injected instruction wrote itself into a copilot's persistent memory and re armed every session

  United States · verified 15 September 2026

  The research states the injected instruction remains active in every future session for that user unless the user manually navigates to memory settings and deletes it.