💡 Agent Prompt Injection Threat Model and CI Hardening Playbook

[github-actions[bot]]

Summary

Create a comprehensive threat model and hardening playbook for the org's agentic CI workflows, addressing the "Comment and Control" attack class (March 2026) where PR titles and issue bodies are weaponized to hijack AI agents. The playbook codifies the "Rule of Two" principle: never let an agent simultaneously process untrusted input and hold state-changing tool access.

Market Signal

The agent security landscape has shifted dramatically in Q1-Q2 2026:

• Prompt injection surged 340% YoY per OWASP's 2026 LLM Security Report
• "Comment and Control" disclosure (March 2026): A single PR title simultaneously hijacked Claude Code, Gemini CLI, and GitHub Copilot, exfiltrating repository secrets. Anthropic patched with default-deny filesystem reads and system-prompt hardening
• Microsoft disclosed a Claude Code GitHub Action vulnerability (CVSS 9.6) in May 2026 — the agent could be tricked into reading sensitive CI runner files
• NSA published "MCP: Security Design Considerations for AI-Driven Automation" (17 pages, May 20, 2026), recommending filtering proxies, sandboxing, message integrity checks, and output validation
• Industry consensus: Prompt injection cannot be fully solved within current LLM architectures — layered defense is the only viable approach
• The "Rule of Two" governance pattern emerged: never let an agent simultaneously process untrusted input and hold state-changing tool access

Sources: CSA Research Note, Comment and Control disclosure, NSA MCP Guidance (PDF)

User Signal

The org runs five agent-driven workflows that process untrusted inputs:

Workflow	Untrusted Input Sources	Privileges Held
dev-lead.yml	Issue titles, labels, bodies	Code write, issue write
feature-ideation.yml	Discussion titles, bodies	Discussions write
compliance-audit.yml	API responses, file contents	Issues write, PRs
claude-code-reusable.yml	PR diffs, review comments	Code write, PR write
agent-shield.yml	PR content (deliberately)	Read-only (good)

Existing ideas #269 (Agent Shield v2) and #367 (Agent Input Sanitization) address individual pieces but no unified threat model ties them together. The feature-ideation auto-enhance work (PR #448) introduced a new attack surface where Discussion content is processed by an agent.

Technical Opportunity

The existing agent-shield.yml provides a runtime detection foundation. ci-standards.md already mandates action pinning and permission scoping. A unified threat model would connect these existing controls with new defenses:

1. Input sanitization at workflow boundaries (strip control characters, limit length, detect injection patterns)
2. Privilege separation between input processing steps and mutation steps
3. Output validation before agent-generated content is posted to GitHub
4. The Rule of Two architecture: split agent workflows into a read-only analysis phase and a separate, validated mutation phase

Assessment

Dimension	Score	Rationale
Feasibility	high	Primarily documentation + architectural patterns, not new tooling
Impact	high	Addresses #1 security risk for agentic CI (OWASP, NSA, CSA all flag it)
Urgency	high	Active exploitation in the wild; org runs 5 agent workflows with untrusted inputs

Adversarial Review

Strongest objection: The org already has agent-shield.yml and existing ideas #269 (Agent Shield v2) and #367 (Agent Input Sanitization). Is this just duplication?
Rebuttal: Agent-shield is a runtime detection tool — it detects attacks after they happen. Ideas #269 and #367 are point solutions for specific attack vectors. This playbook is the strategic layer above them: a threat model that maps the org's actual attack surfaces to controls, identifies gaps, and prioritizes hardening work. The "Comment and Control" disclosure, Microsoft CVE, and NSA MCP guidance provide new urgency and structure that didn't exist when those ideas were proposed in May 2026. The playbook references agent-shield as one control among many, giving it architectural context.

Suggested Next Step

Draft a standards/agent-ci-threat-model.md covering:

1. Attack surface inventory (which workflows process untrusted input, with what privileges)
2. The Rule of Two principle and privilege separation architecture
3. Input sanitization patterns for each untrusted input type
4. Output validation requirements for agent-generated content
5. A per-workflow hardening checklist with current status and gaps

[github-actions[bot]]

Weekly Update

What Changed

Three critical real-world incidents strengthen the case for this threat model:

1. CVE-2025-66032 (disclosed Jun 1, 2026): Anthropic's Claude Code GitHub Action had a critical authorization bypass (CVSS 7.8). The checkWritePermissions function unconditionally trusted any GitHub App actor. An attacker could inject a prompt via an issue title, leak ACTIONS_ID_TOKEN_REQUEST_TOKEN, and push malicious code to the action repo itself. Fix: update to v1.0.94+, pin actions to SHAs, remove allowed_non_write_users: "*". (Source: CSA Research Note)

2. Clinejection (Feb 17, 2026): A malicious GitHub issue title exploited four chained vulnerabilities in the Cline AI coding tool, compromising its npm package for approximately 8 hours. Demonstrated the full attack chain from prompt injection to supply chain compromise. (Source: Waxell research)

3. OWASP confirmation (Jun 11, 2026): OWASP published analysis confirming prompt injection remains the Addressing PR comments #1 failure mode in production agentic AI systems. Not theoretical — actively exploited in the wild. (Source: Help Net Security)

actions/checkout v7 (Jun 18, 2026) now blocks fork PR checkouts in privileged contexts by default, closing one major vector in the pwn-request attack pattern. See new Discussion #533.

Updated Assessment

Dimension	Previous	Current	Delta
Feasibility	high	high	→
Impact	high	high	→
Urgency	med	high	↑

Recommendation

Advance — urgency increased. The CVE-2025-66032 demonstrates that the exact attack patterns this threat model addresses are being actively exploited against AI coding agents in CI. The org uses Claude Code in CI workflows — the affected toolchain. Prioritize: (1) audit all agent workflows for untrusted input exposure, (2) document the trust boundary between issue/PR content and agent prompts, (3) add OIDC token scoping to limit blast radius of compromised sessions.