AI Coding Agents Have CI/CD Access Now — What Went Wrong in 2026

AI coding agents don't just autocomplete anymore. Plugged into GitHub Actions, they can read an issue, decide it needs a code change, run tests, and open a pull request — without a human in the loop. If that mix of "impressive" and "makes you a little nervous" feels familiar, that instinct is well-founded. Some setups even let an agent publish a release. That's a real productivity gain, and also a new attack surface: everything the agent reads is untrusted internet text, and untrusted text an agent treats as instructions is exactly what prompt injection exploits. 2026 produced several concrete examples of it going wrong.

The Cline incident

Cline is a popular open-source coding agent distributed as a VS Code extension and npm CLI package. In February 2026, researcher Adnan Khan disclosed a chain he called "Clinejection." Cline's repository used a Claude-based bot to auto-triage new GitHub issues, acting on text in the issue itself — a crafted issue title could inject instructions poisoning the shared Actions cache, pivoting from the low-privilege triage job into the publish workflows holding Cline's npm and Marketplace tokens.

The window ran December 21, 2025 to February 9, 2026, when Khan disclosed it. On February 17, before it was fully closed, someone used a stolen token to publish a malicious cline@2.3.0 — a postinstall script silently running npm install -g openclaw. It stayed live about eight hours, downloaded around 4,000 times before Cline caught it — damage entirely in that one extra install step, easy to miss in a routine bump. Cline's response: remove the automated bot review workflow and strip the shared cache from its pipeline.

Anthropic's Claude Code Action had two separate issues

Cline wasn't the only agent with this class of problem. Anthropic's own claude-code-action for GitHub — the official way to run Claude Code inside CI — had two distinct vulnerabilities disclosed and fixed in 2026. The first, reported by RyotaK of GMO Flatt Security in January, was a permission-check bypass: the action trusted any account that merely looked like a "bot," when anyone can register a GitHub App. Combined with indirect prompt injection, an attacker could get Claude to read /proc/self/environ and leak workflow credentials. Anthropic fixed it within four days, rated it 7.8 on CVSS v4.0. The second, found by Microsoft in April, was narrower: the Bash tool ran sandboxed with scrubbed environment variables, but the Read tool didn't, so a prompt-injected "read" could still pull an API key. Anthropic blocked /proc/ reads outright on May 5.

Neither flaw is known to have been exploited against Anthropic's own repository the way Cline's was, but the pattern is the same: an agent with shell or file-read access, fed untrusted text, found a path to credentials it was never supposed to touch.

The warning about what's coming next

At the end of June, Mozilla's threat research group published a proof-of-concept showing a variant that doesn't even need a compromised CI workflow. A malicious repository can contain ordinary-looking setup instructions paired with a package engineered to fail on first run and prompt the developer (or agent) to run an "initialization" command — which fetches a payload through DNS TXT records, a channel invisible to code review and most static analysis. Mozilla's recommendation: treat setup scripts in unfamiliar repositories as untrusted code, regardless of what your AI tool says.

What this actually means if you use these tools

None of this argues against AI coding agents, just against giving them more trust than the access they need. A few things worth doing if running one in CI:

• Don't let a triage/issue-handling bot share credentials or caches with your publish/release pipeline. That's the chain both Cline and the Claude Code Action bypass relied on.
• Scope tokens narrowly and rotate them. A workflow that only comments on issues shouldn't touch an npm publish token.
• Treat any text an agent reads from outside your control as untrusted input, same as unsanitized user input in a web app.
• Keep human review on anything touching secrets or publishing artifacts.

The properties that make agentic coding useful — shell access, acting on plain-language instructions, multi-step autonomy — are the same ones that make these attacks possible. That trade-off isn't going away, so the practical move is architecting around it, not hoping this year's patches were the last needed.

Sources: The Hacker News on Claude Code Action, Microsoft Security Blog, Khan's Clinejection writeup, The Hacker News on Cline, Mozilla warning coverage.