Agent Incident RegistryAIR
v1 · updated 19 Oct 2026
Disclosed vulnerability

A WIF of fresh access: a prompt-injected GitHub issue on Gemini CLI escalates to Editor-level access on a Google GCP project

AIR-2026-0199 AIR record · 2026-08-google-gemini-cli-wif-gcp-compromise
Open in dashboard About
From the supporting source
The only wrinkle is log masking. GitHub masks tokens and secrets in action logs, so gemini has to be asked to chunk the output into groups of 4 characters.pillar.security
The record
Disclosed
2026-08-18
Vendor
Google
Product
google-github-actions/run-gemini-cli; @google/gemini-cli triage workflow
Risk domain
Access control and permissions › Credential theft
Also touches
Privilege escalation, Confused deputy
System type
Generative model
Who acted
Agent acted — the CI agent executed and escalated to Editor on the GCP project
Attack surface
Coding agent
Autonomy level
Fully autonomous
Initial vector
Indirect prompt injection github issue
Impact type
Credential theft, Privilege escalation, Remote code execution
Confidence
High
Submitted by
EAI Internal
Crosswalk
OWASP Agentic Top 10 (2026)
ASI03 – Identity and Privilege Abuse
MITRE ATLAS
AML.T0012 – Valid Accounts
NIST AI RMF
MEASURE 2.7
EU AI Act
Article 13
ISO/IEC
TR 24028; 42001; 23894
AIUC-1
B. Security
Scope
tool failure
Mitigation
Use secure credential storage; Implement short-lived tokens.
Taxonomy
Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Google GCP projects backing the Gemini CLI CI/CD automation
Capability abused
ci_workflow_executionshell_executionfile_readnetwork_egress
Defense & remediation
Recorded defense
GitHub Actions secret log masking; tool allowlist via coreTools
Guardrail kinds
Permission scope
Guardrail outcome
Silent
Fix shipped
fixed - serviceAccountTokenCreator scoped to specific resources, OIDC credentials added to .geminiignore, tool scoping logic updated; verified 2026-08-14
Taxonomy & references
OWASP ASI01 Agent Goal HijackOWASP ASI04 Agentic Supply Chain VulnerabilitiesOWASP ASI05 Unexpected Code Execution (RCE)OWASP ASI03 Identity and Privilege Abuseci_cd_agentworkload_identity_federationoidc_credential_theftlog_masking_bypassdeprecated_tool_scoping
Curator notes
Pillar Security (Dan Lisichkin). Reported 2026-06-11, fix verified 2026-08-14, published 2026-08-18 with a Google bounty. Chain: public issue -> autonomous triage agent with over-broad tools (deprecated coreTools field) -> RCE on the runner -> plaintext WIF/OIDC credentials -> service account impersonation -> Editor on the GCP project. The 4-character chunking trick to defeat GitHub's secret masking is reusable and worth tracking as a technique.
Supporting sources
Cite as
Enkrypt AI. "A WIF of fresh access: a prompt-injected GitHub issue on Gemini CLI escalates to Editor-level access on a Google GCP project". AIR, AIR-2026-0199. https://agentincident.vercel.app/i/AIR-2026-0199/ (accessed 2026-10-19).