Fork-Triggerable AI Coding Agents in CI: A Wide-Net Survey

Abstract

AI coding agents are increasingly wired directly into continuous integrationpipelines to triage issues, review pull requests, and land fixes. This paperidentifies a composition of three properties that turns such an integration into a repository-takeover primitive: the job runs on an event an outside contributor can trigger, it can write to the repository or holds a token that can, and nothing checks who triggered it. When these coincide, untrusted pull-request or comment text reaches an agent holding a write-scoped token, and prompt injection becomes code execution and repository mutation under continuous-integration credentials, with no maintainer action required. We built a static scanner for this exact primitive and ran it against an opportunistically collected corpus of 73,937 real-world workflow files from 16,864 projects on GitHub Actions and GitLab CI. The scanner reasons per job about fork reachability, the presence of a genuine author gate, and write capability, rather than pattern-matching on tool names. It found 589 fork-triggerable agent vulnerabilities in 534 of the scanned projects, spanning 28 agent families across both platforms. On a blind subset of 3,391 previously unseen files, precision was approximately 98 percent, rising to near 100 percent after several false-positive classes were closed, with no hangs or timeouts across the corpus. Exposure is not concentrated in brand-name assistants but in a widely used pull-request-review action and an open-source coding agent, with the rest spread across smaller integrations that reproduced the same insecure pattern. The enabling configuration is widespread, and it is detectable and fixable statically in the workflow definition before any agent runs. Only anonymized aggregate statistics are reported, in keeping with coordinated disclosure; no affected project is named.