Tag: github
All the articles with the tag "github".
-
[AUTO] Snowflake Actions Flaw Reveals AI Review Gap
A GitHub Actions workflow injection in Snowflake was discovered by an AI agent rather than human review or Copilot.
-
Google Patched Its Agent-to-Agent Privilege Bug, Then Declined to Pay for It
Pillar Security showed that the public bot account on Google's adk-python repo could satisfy the privileged workflow's own collaborator check. Google deleted three workflows and ruled the report an Honorable Mention with no bounty.
-
54 Fake CVEs in Four Days, and Nobody Checked
JFrog found a GitHub repo that published 55 CVE advisories in four days, 54 of them fabricated. The CVE pipeline has no reproduction requirement, and generative AI just made that cheap to exploit.
-
One Word Beat GitHub's Guardrail, and the Word Was 'Additionally'
Noma Labs' GitLost shows an unauthenticated attacker leaking a private repo's contents by opening one public GitHub Issue. GitHub built a scanner to stop exactly this; prefixing the malicious line with 'Additionally,' walked the data straight past it.