Researchers Hack AI Agents on GitHub to Steal Credentials

Integrating artificial intelligence into software development promised unprecedented efficiency, but in practice it has opened the door to fundamentally new attack vectors. A team of security researchers at Johns Hopkins University has demonstrated a critical vulnerability in AI agents from leading tech giants that run on the GitHub Actions platform. The researchers not only compromised systems built by Anthropic, Google and Microsoft, but also showed that confidential credentials can be stolen with no obstacles. The case stands out for more than its technical sophistication: after paying bounties for the bugs, the companies chose to stay silent and skipped public disclosure through official vulnerability identifiers.

To grasp the scale of the problem, it helps to understand the role GitHub Actions plays in modern continuous integration and deployment infrastructure. The platform automates building, testing and releasing code. To do that, it needs access to the deep layers of repositories and to confidential secrets such as access tokens, database passwords and API keys. Embedding autonomous AI agents in this environment was pitched as the next step in the evolution of the toolchain, letting algorithms analyze changes on their own, propose fixes and even manage configurations. But handing language models such broad powers inside a trusted environment created ideal conditions for abuse and turned virtual assistants into the weakest point of the security perimeter.

The researchers' attack rests on a novel form of prompt injection. Unlike traditional hacking, which exploits bugs in program code, this approach exploits the very nature of large language models by manipulating their ability to interpret natural language. The attackers planted specially crafted instructions in seemingly harmless places such as code comments, issue descriptions and pull requests. When an AI agent integrated into a GitHub Actions pipeline processed these texts during routine analysis, it picked up the hidden commands without the repository owner noticing. As a result, the model bypassed its built-in safety restrictions and obediently extracted the requested authorization tokens, sending them to the attackers' servers disguised as ordinary network requests.

Perhaps the most troubling aspect of the case is the reaction of the corporations involved. Anthropic, Google and Microsoft acknowledged the legitimacy of the research and even paid the researchers the bounties due under their vulnerability reward programs. Yet they declined to comment publicly and refused to publish official security advisories with CVE numbers. This policy of complete opacity creates a dangerous illusion of safety. Without a standardized notification, automated security scanners will not flag these integrations as vulnerable, and millions of developers worldwide will keep using the compromised approaches with no idea that the keys to their digital infrastructure could be stolen with a couple of lines of text.

Such silence raises serious questions about the balance between marketing AI and taking real responsibility for user security. Language models are being integrated into critical development workflows at a rapid pace, and many companies adopt these solutions to chase trends without the expertise to assess the accompanying risks. AI agents with access to production code effectively become insiders with unlimited privileges.

If such systems can be fooled by simple linguistic manipulation, what is at risk is not just the intellectual property of individual projects but the integrity of the entire software supply chain. An attacker who gains control of GitHub Actions through a vulnerable AI agent could inject malicious code into the final product, potentially affecting millions of end users.

The incident is a stark reminder that security architecture in the age of AI requires fundamentally new standards. Traditional methods of protecting development pipelines are powerless against attacks on the logic of the algorithms themselves. The industry will need to build robust isolation mechanisms for AI agents and strict rules for auditing their actions in trusted environments. As long as the tech giants choose to hide systemic flaws instead of discussing them openly, responsibility for data safety falls entirely on engineering teams. Developers need to be extremely cautious when granting permissions to any autonomous tool and to critically evaluate every stage of its integration, remembering that invisible vulnerabilities are often the most destructive.