Research map / Adversarial robustness and security / Attacks on text and graphs

GitInject: Real-World Prompt Injection Attacks in AI-Powered CI/CD Pipelines

NeurIPS 2026 · Adversarial robustness and security › Attacks on text and graphs · approach: LLM jailbreak and injection defense · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Introduces GitInject, an open-source framework that runs prompt-injection attacks against live GitHub Actions AI workflows on ephemeral repositories, documenting eleven named attacks across four providers and their workflow-level countermeasures.

Problem

Prompt injection risks for AI agents embedded in CI/CD pipelines are poorly studied, and simulated agent benchmarks miss infrastructure constraints (sandboxing, credential handling, permissions) that determine whether attacks succeed in production.

Approach

Evaluate attacks by executing real GitHub workflows against ephemeral repositories and judging outcomes via ground-truth repository state, rather than simulating tool calls; also identifies config-file injection (CLAUDE.md, AGENTS.md, GEMINI.md) as operator-trust attack surface.

Key results

• Simulation (AgentDojo) misses 71.2% of confirmed real attacks (57 of 80) and flags 5.0% of infrastructure-blocked attacks as successful over n=100 runs.
• Config-file injection succeeded on 2/2 scenarios for claude-sonnet-4-5, claude-haiku-4-5, gemini models, and gpt-5, while pr_body token exfiltration succeeded on gpt-4o-mini and codex-pr-review.
• Denial-of-wallet costs the owner about $1.11 per attack PR; a 2-hour campaign costs $32-$111.

Surprising findings

• Persist-credentials: false is insufficient for Gemini API key exfiltration because credentials are written to /tmp regardless of the flag.
• A fork-triggered workflow_run attack that succeeded in simulation never works in reality because GitHub does not populate pull_requests for forked repositories.

Limitations

• Results reflect specific model versions and workflow configurations at evaluation time.
• Attack enumeration is not exhaustive; Fails cells only mean the named attack did not succeed.
• Bitbucket and GitLab generalization is largely based on documentation and structural analogy, with only one GitLab port tested.

Experimental setup

Datasets: AgentDojo injection tasks (CI/CD suite of ten, constructed by authors)

Benchmarks: AgentDojo (CI/CD suite of 10 tasks, comparison) GitInject live GitHub workflows (11 named attacks)

Metrics: attack success rate confusion matrix vs simulation denial-of-wallet cost

Baselines: AgentDojo

Builds on: AgentDojo spotlighting StruQ HouYi

Closest papers by meaning

• Skill-Inject: Measuring Agent Vulnerability to Skill File Attacks (NeurIPS 2026 · similarity 0.84)
• MOSAIC-Bench: Measuring Compositional Vulnerability Induction in Coding Agents (NeurIPS 2026 · similarity 0.84)
• MCPTox: A Benchmark for Tool Poisoning on Real-World MCP Servers (AAAI 2026 · similarity 0.84)
• QUT-DV25: A Dataset for Dynamic Analysis of Next-Gen Software Supply Chain Attacks (NeurIPS 2025 · similarity 0.83)
• VPI-Bench: Visual Prompt Injection Attacks for Computer-Use Agents (ICLR 2026 · similarity 0.83)
• SEC-bench: Automated Benchmarking of LLM Agents on Real-World Software Security Tasks (NeurIPS 2025 · similarity 0.83)