Hijacking Google’s CI/CD Through Prompt Injection:The New Era of AI-Based Exploits
summary
Aikido Security demonstrates that prompt injection moves from nuisance to critical when AI agents inside CI/CD have privileged tool access, showing reproducible exploits against multiple Fortune 500 pipelines including Google that lead to credential exfiltration and unauthorized command execution. The attack chain uses untrusted issue/pull request text fed to models (Gemini, Claude) via Gemini CLI core tools or similar, then leaks tokens. Practical fixes are to run models with no tokens, remove edit/comment tools, and separate privileges so LLMs cannot access secrets.
AI-written summary · about
chapters (22)
- 0:00AI-driven CI/CD exploits
- 1:11Why Google
- 2:13Prompt injection basics
- 4:00Prompt injection as social engineering
- 6:29Prompt injection unsolvable
- 8:34Evolution of prompt injection
- 9:16AI agents in CI/CD risk
- 11:43GitHub Actions AI use cases
- 13:49Gemini CLI vulnerability
- 16:39Dangerous AI tools
- 18:02Live demo: secret leakage
- 19:10How Google fixed the vulnerability
- 20:34New CI/CD vulnerability class
- 21:59Other vulnerable tools
- 23:02Detecting prompt injection
- 24:06Threat modeling AI agents
- 25:52AI-driven data exfiltration
- 26:56Three defense principles
- 27:58AI as security proxy
- 29:44Future of embedded AI
- 31:49OpenClaw skills risks
- 32:10AI security challenges
related talks
51mPrompt Injection: When Hackers Befriend Your AI
40mThe Mechanisms That Enable Misuse and What We Can Do About It
36mAgentic AI Under Attack: Live Demos of Exploits Through Autonomy and Trust
33mAgentic ProbLLMs: Exploiting AI Computer-Use and Coding Agents
26mWhen AI Gets Manipulated: Security Risks in LLM Applications
23mVibes Not Vulns: Securing the Era of AI-Written Software
46mNot My Vibe: When AI Coding Agents Go Off the Rails
54mA Practical Guide to AI Threats & Mitigation Strategies