Researchers Hack Google’s Gemini CLI Through Prompt Injections in GitHub Actions

PromptPwnd is a critical prompt-injection vulnerability affecting AI agents used in CI/CD pipelines (e.g., GitHub Actions, GitLab). By embedding untrusted content (issue titles, PR bodies) directly into AI prompts, attackers can trick models into running privileged commands (editing issues, running shell commands) and exfiltrating tokens or secrets; researchers demonstrated a PoC against Gemini CLI, multiple large organizations were exposed prior to patches, and vendors released fixes and mitigation guidance.