ClarityBeta

Security & Threat Intelligence

The Watch

6 min read · 1,139 words · 3 moves to watch
The Signal

A GitHub Actions misconfiguration exploiting pull_request_target workflows compromised 48

Attackers who submit a pull request to any affected repo get write permissions and secret access in the target repository's context. If Trivy is in your pipeline, verify binary integrity today and audit every workflow in your org for this pattern — your security scanner may have become the supply chain attack vector.

In Play

  1. GitHub Actions Supply Chain Compromise Hits Security Tooling

    The pull_request_target trigger grants write permissions and secrets to untrusted PR code. 48 repos hit including Trivy, used in millions of CI/CD pipelines globally. A compromised scanner running with elevated privileges becomes the ideal supply chain injection point.

    Ask Clarity

  2. AI-Generated Code Confirmed Causing Production Outages at Scale

    Amazon confirmed AI-generated code caused a 13-hour AWS outage (Kiro tool) and a 6-hour retail outage, forcing mandatory senior sign-off. METR study: ~50% of benchmark-passing AI patches get rejected by real maintainers. The gap between 'passes CI' and 'production-safe' is now quantified.

    Ask Clarity

  3. AI Vendor Risk Escalation: DoD Designation, Tooling Acquisitions, PE Concentration

    DoD designated Anthropic a supply chain risk while Anthropic plans a Palantir-style JV embedding Claude into 250+ Blackstone portfolio companies. Simultaneously, OpenAI acquired red-teaming platform Promptfoo, creating a conflict of interest if you use it to test OpenAI models. Independent AI security tooling is shrinking.

    Ask Clarity

  4. Non-Human Identity Governance: The Invisible Attack Surface

    200K publicly visible AI agents exist (OpenClaw). Enterprise vendors — HubSpot, Zoom, Adobe — are shipping agentic features with API permissions outside IAM governance. Figma and HubSpot now disclose AI agent risk in SEC filings while their CEOs downplay it publicly. Agent-to-agent trust chains are being platformized via Meta's Moltbook acquisition.

    Ask Clarity

Deep Dives

Your Security Scanner Got Compromised: GitHub Actions Trust Inversion Hits Trivy and 47 Other Repos

What Happened

A systemic vulnerability class in GitHub Actions pull_request_target workflows was exploited to compromise 48 repositories — including Trivy, Aqua Security's container vulnerability scanner deployed in millions of CI/CD pipelines globally. This is the "pwn request" pattern: when a workflow using the pull_request_target trigger checks out the PR submitter's code, it grants an untrusted external contributor write permissions, secret access, and GITHUB_TOKEN in the target repository's privileged context.

Why This Is Worse Than a Typical Supply Chain Attack

Trivy isn't just another dependency — it's your security scanning tool. It runs with elevated privileges across your pipeline to inspect container images and code for vulnerabilities. A compromised Trivy binary or container image becomes the perfect supply chain injection point: it has access to everything it needs to scan, which means access to everything it could exfiltrate or tamper with. Your security tool becomes the attack vector, and it runs in trusted context by design.

Attack PhaseMechanismYour Exposure
Initial AccessSubmit PR to repo with misconfigured pull_request_targetAny repo with this pattern is exploitable by any GitHub user
ExecutionPR head code runs in target repo contextAttacker code executes with your repo's secrets and write perms
ImpactSecret exfiltration, artifact tampering, supply chain injectionTrivy binaries/images in your pipeline may have been tampered

Immediate Actions

Search your entire GitHub org for pull_request_target in workflow YAML files. Any workflow that checks out github.event.pull_request.head.sha or head.ref in this context is vulnerable. Remediate by switching to the pull_request trigger (runs in fork context) or using a workflow_run handoff pattern.

Verify Trivy integrity now. Check binary signatures, container image digests, and cosign signatures against known-good values from Aqua Security. Review recent scan results for anomalies — false negatives on known CVEs or unexpected network calls during scans could indicate a compromised scanner.

If your security scanning tool's build pipeline can be compromised by anyone who submits a pull request, your entire CI/CD trust model needs rebuilding — not patching.

What to do

  1. Search all GitHub org repos for pull_request_target in workflow YAML files and remediate any that checkout PR head code in target context

  2. Verify Trivy binary signatures, container image digests, and cosign signatures against Aqua Security's known-good values

  3. Review Trivy scan results from the past 30 days for anomalies: false negatives on known CVEs or unexpected network behavior during scans

  4. Implement org-wide GitHub Actions policy requiring security review for all workflows using pull_request_target

Amazon Confirms AI-Generated Code Caused 13-Hour AWS Outage — And the Failure Rate Is Now Quantified

The Confirmation You Needed

Amazon has moved from theoretical risk to confirmed production impact. AI-generated code from their Kiro coding tool caused a 13-hour AWS disruption and a separate ~6-hour retail outage — described internally as "high blast radius" incidents affecting multiple services. Amazon's response: mandatory senior engineer sign-off on all AI-assisted code changes from junior and mid-level staff. They are now treating AI-generated code as untrusted input.

This matters beyond Amazon because the failure modes are universal. Multiple independent sources this week quantified the gap between what AI code does on benchmarks and what happens in production:

The Numbers That Reframe Your Risk

  • METR study (296 PRs): Roughly 50% of AI-generated patches that pass SWE-bench benchmarks would be rejected by real maintainers of scikit-learn, Sphinx, and pytest. Benchmark pass rates materially overstate production quality.
  • Stripe benchmark: Claude Opus 4.5 scores 92% accuracy on full-stack integration tasks. The remaining 8% is where vulnerabilities and cascading failures live.
  • NYT guardrail model: Constrained AI to test generation only (read-only source access), achieving 28% → 83% test coverage with 70% less effort — net-positive for security because AI never touched production code.

Why This Is Different From Last Week's Coverage

Previous briefings covered AI agent access models — terminal access, sandbox architecture, OAuth scopes. Today's intelligence is about confirmed outcomes: specific outage durations, quantified failure rates, and mandated policy responses from the world's largest cloud provider. The threat has moved from "could happen" to "happened, cost 13 hours of AWS availability, and forced governance changes."

Cross-Source Pattern

Five independent sources this week converged on the same conclusion: AI-generated code passes automated checks but fails in production at rates organizations aren't prepared for. The recursive trust problem is compounding — platforms like Anthropic's Claude Code Review now deploy multi-agent systems to review AI-generated code, meaning AI reviews AI with decreasing human oversight.

Amazon proved the blast radius. METR quantified the failure rate. The NYT showed the safe path. The question is whether your org learns from their data or generates its own incident.

What to do

  1. Implement AI-generated code tagging in commit metadata (e.g., ai-assisted: true trailer) and route tagged PRs to senior reviewers by end of sprint

  2. Classify AI-generated code as untrusted input in your SDLC documentation and update change management controls for SOC 2 CC8.1 compliance

  3. Pilot AI-for-testing-only model (NYT approach): restrict AI to test generation with read-only source code access for one team this quarter

  4. Instrument CI/CD to track percentage of AI-generated code per repository as a leading indicator for review capacity planning

DoD Flagged Anthropic as a Supply Chain Risk While PE Embeds It Into 250+ Companies — Map Your Exposure

Two Contradictory Signals, One Vendor

The U.S. Department of Defense has formally designated Anthropic as a supply chain risk and the two are in an escalating legal battle. Simultaneously, Anthropic is forming a Palantir-style consulting joint venture with Blackstone and Hellman & Friedman to embed Claude deeply into the operational infrastructure of 250+ portfolio companies. Anthropic's annualized revenue has hit $19 billion, and Blackstone already holds a $1 billion stake — this isn't a pilot.

The tension is the insight: the U.S. military considers Anthropic a supply chain risk while the private equity ecosystem is about to make it a load-bearing dependency for hundreds of enterprises simultaneously.

What the DoD Designation Means for You

DoD supply chain risk designations are not casual. They can trigger:

  • Flow-down contractual requirements to defense contractors and subcontractors
  • Scrutiny from FedRAMP and CMMC auditors on AI vendor choices
  • Informal pressure on government-adjacent orgs to reduce Anthropic exposure
  • Potential future export control or sanctions actions if the legal dispute escalates

The specific basis for the designation is not publicly disclosed. But the signal alone should trigger a third-party risk review for any organization with Anthropic in its stack.

Compounding Risk: AI Security Tooling Consolidation

In a related development, OpenAI acquired Promptfoo — a platform specializing in AI vulnerability identification, red-teaming, and remediation — integrating it into the OpenAI Frontier enterprise platform. If you use Promptfoo to red-team OpenAI models, you now have a conflict of interest in your testing toolchain. The pattern mirrors cloud security consolidation: independent tools get absorbed by the platform they're supposed to audit.

Between the DoD designation on Anthropic and OpenAI absorbing its red-teaming ecosystem, the independent AI security assessment landscape is contracting while AI deployment is accelerating. This is the vendor risk equivalent of your auditor being acquired by the company they audit.

When the Department of Defense calls your AI vendor a supply chain risk and private equity simultaneously plans to embed that vendor into 250+ companies, someone's risk calculus is wrong — make sure it isn't yours.

What to do

  1. Audit vendor inventory for all Anthropic/Claude dependencies — direct API usage, SaaS products embedding Claude, and internal tools using Anthropic models — by end of this sprint

  2. If using Promptfoo for AI red-teaming, evaluate alternative frameworks (Garak, Microsoft Counterfit, custom harnesses) and document the independence gap analysis this quarter

  3. Add AI supply chain concentration risk to next board risk briefing with specific Anthropic/OpenAI dependency data

  4. Set monitoring alerts for Anthropic-DoD legal developments — if this escalates to sanctions or export restrictions, you need contingency plans ready, not scrambling

The bottom line

Your CI/CD pipeline trusts Trivy, which was just compromised through a GitHub Actions flaw affecting 48 repos — while Amazon confirmed that AI-generated code caused a 13-hour AWS outage and METR quantified that half of benchmark-passing AI code gets rejected by real maintainers — and the DoD just flagged Anthropic as a supply chain risk at the exact moment private equity plans to embed it into 250+ companies. The CI/CD supply chain, the code your developers ship, and the AI vendors you depend on are all less trustworthy today than they were yesterday, and each requires a different remediation on a different timeline.