Researchers showed how a public-facing AI agent in Google’s ADK Python repo could be manipulated to trigger a higher-privileged workflow by posting a crafted “@gemini-cli <prompt>” comment on a pull request. This could expose secrets and help fabricate a believable (but false) trail that an automated reviewer triaged, reviewed, and approved a malicious change, though a human still had to merge it, requiring social engineering.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Imagine a GitHub bot that can secretly approve a malicious PR… and make it look like a legit review. Researchers showed a Gemini bot on GitHub where a simple PR comment like '@gemini-cli run security checks' actually triggered a hidden workflow called 'gemini-invoke' with access to every bash command and its GitHub token. They even chained it: one PR with malicious code, a second PR full of prompts telling Gemini to mark the first as triaged, reviewed, and approved, manufacturing a fake audit trail that suggests, 'a human asked, Gemini reviewed, Gemini approved.' Here’s the move: before you merge anything risky, ignore the bot trail and do your own review, treat bot comments and approvals as hints, never as proof that the change is safe.
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
Security researchers showed that simply opening a GitHub issue could trigger default CI workflows in popular coding-agent projects and lead to code execution or secret exposure. The weaknesses were not in the AI models themselves, but in the surrounding automation (“harness”) that allowed untrusted…
Researchers found real GitHub repositories containing poisoned AI-agent instruction/config files (like CLAUDE.md and .cursorrules) that silently tell coding assistants to steal prompts, environment variables, and credentials. The malicious instructions can trigger hidden commands (for example, curl…
Attackers used a sponsored search ad to send macOS users to a fake “OpenAI Codex download” page hosted on Google Sites. The page convinced victims to open Terminal and paste a command that secretly downloaded and ran a multi-stage malware infection.
Researchers showed that a single public GitHub issue (from someone with no repo access) could steer popular AI coding agents into running dangerous commands, exposing tokens, and changing repositories. The risk comes from AI agents reading untrusted issue/PR text while also having access to…
Attackers are buying sponsored Google search ads that send Mac developers to fake OpenAI Codex download pages. The pages instruct victims to paste a Terminal command that looks like a normal install step, but actually downloads and runs a multi-stage malware payload.
