Executive Summary
Vectra AI summarizes agent-security cases including persistent data exfiltration from ChatGPT and secret exposure through a Claude Code GitHub Action, framed against MITRE ATLAS and tool poisoning.
What Happened
Vectra AI summarizes agent-security cases involving persistent data exfiltration from ChatGPT and secret exposure through a Claude Code GitHub Action. The examples emphasize that prompt injection persistence and incomplete sandboxing can enable access to sensitive data or credentials.
Affected Products
- ChatGPT
- Claude Code GitHub Action
Vulnerability / Attack Technique
Persistent prompt injection and tool poisoning leading to data and secret exposure
Technical Mechanism
The cases show prompt-injection persistence enabling ongoing exfiltration, and incomplete sandboxing letting an agent running in a GitHub Action expose secrets.
AI Security Category
LLM01:2025 Prompt Injection
Part of the Prompt Injection topic.
Relevant Frameworks
RealGround Analysis
Agents in CI pipelines often see secrets by default. RealGround analysis: once injected instructions persist, every later run is compromised, so sandboxing and secret scoping matter more than prompt filtering alone.
Recommended Controls
- Run CI agents without access to repository secrets unless required
- Sandbox agent execution and restrict outbound network access
- Clear or validate persisted agent state between runs
- Scan agent outputs and logs for leaked secrets
Related RealGround Service
AI Security Readiness Assessment · or start with the free AI Agent Security Scanner.
Sources
Vectra AI: https://www.vectra.ai/topics/ai-agent-security
Summary and analysis written by RealGround from the source above; last updated 2026-10-17.