# CI agent overpermission

## Summary

- Pattern id: `ci-agent-overpermission`
- Linked incidents: 3

A prompt-injected agent has tool permissions far beyond the review or triage task.

## Affected Surfaces

- github_actions
- gitlab_ci
- workflow_token

## Defensive Controls

- Least privilege tokens
- Read-only default tools
- No shell in untrusted-trigger workflows

## Linked Incidents

- `clinejection-github-issue-title`: Clinejection via GitHub issue title (reported, P0)
- `promptpwnd-ci-agents`: PromptPwnd in GitHub Actions and GitLab CI/CD AI-agent workflows (reported, P0)
- `claude-code-action-secrets-exposure`: Claude Code GitHub Action secrets exposure via untrusted content (reported, P0)

## Agent Families Seen

- Claude Code: 3
- GitHub Actions: 2
- Cline: 1
- Gemini CLI: 1
- OpenAI Codex: 1
- GitHub AI Inference: 1

## Source IDs

- `snyk-clinejection`: https://snyk.io/blog/cline-supply-chain-attack-prompt-injection-github-actions/
- `grith-clinejection`: https://grith.ai/blog/clinejection-when-your-ai-tool-installs-another
- `vectara-awesome-agent-failures`: https://github.com/vectara/awesome-agent-failures
- `aikido-promptpwnd`: https://www.aikido.dev/blog/promptpwnd-github-actions-ai-agents
- `microsoft-claude-code-action`: https://www.microsoft.com/en-us/security/blog/2026/06/05/securing-ci-cd-in-agentic-world-claude-code-github-action-case/

## Safety Note

This page summarizes defensive patterns and intentionally omits working exploit payloads.