Researchers showed how a public-facing AI agent in Google’s ADK Python repo could be manipulated to trigger a higher-privileged workflow by posting a crafted “@gemini-cli <prompt>” comment on a pull request. This could expose secrets and help fabricate a believable (but false) trail that an automated reviewer triaged, reviewed, and approved a malicious change, though a human still had to merge it, requiring social engineering.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Imagine a GitHub bot that can secretly approve a malicious PR… and make it look like a legit review. Researchers showed a Gemini bot on GitHub where a simple PR comment like '@gemini-cli run security checks' actually triggered a hidden workflow called 'gemini-invoke' with access to every bash command and its GitHub token. They even chained it: one PR with malicious code, a second PR full of prompts telling Gemini to mark the first as triaged, reviewed, and approved, manufacturing a fake audit trail that suggests, 'a human asked, Gemini reviewed, Gemini approved.' Here’s the move: before you merge anything risky, ignore the bot trail and do your own review, treat bot comments and approvals as hints, never as proof that the change is safe.
Researchers found real GitHub repositories containing poisoned AI-agent instruction/config files (like CLAUDE.md and .cursorrules) that silently tell coding assistants to steal prompts, environment variables, and credentials. The malicious instructions can trigger hidden commands (for example, curl…
Researchers showed that a single public GitHub issue (from someone with no repo access) could steer popular AI coding agents into running dangerous commands, exposing tokens, and changing repositories. The risk comes from AI agents reading untrusted issue/PR text while also having access to…
Researchers showed that AI coding agents from Anthropic, Google, and OpenAI could be tricked by untrusted GitHub inputs (like an issue or workflow file) into taking unsafe actions. In the demos, a single malicious issue or writable workflow file could lead to remote code execution, stolen…
CrowdStrike reports attackers increasingly bypass security tools by using trusted login paths, phone-based IT impersonation, and abuse of legitimate cloud and AI services. The report highlights real intrusions where vishing led to single sign-on takeovers and rapid data theft, and where attackers…
Researchers found a real-world workflow flaw in Google’s Agent Development Kit (Python) repo where a low-privilege AI triage bot could be manipulated with prompt injection to trigger a higher-privilege maintainer agent. The attack uses “poisoned” pull requests to create a believable review/approval…
Researchers documented a real macOS data-stealing campaign that relies on social engineering instead of software bugs. Victims are sent to a fake “verification” page that tells them to copy and paste a command into Terminal, which silently installs a stealer and then pressures them to enter their…
