攻击者可通过评论操控自动化工作流，窃取用户密钥等敏感信息。
Comment and Control: Hijacking Agentic Workflows via Context-Grounded Evolution
- 基于上下文演化技术，自动构造能诱骗LLM Agent执行恶意操作的输入。
- 在4714个GitHub工作流和8个n8n模板中成功实现劫持，包括官方工具链。
- 发现15个主流GitHub Actions及2个n8n节点存在风险，已获厂商修复与奖励。
自动化平台如GitHub Actions和n8n正越来越多采用集成大语言模型（LLM）代理的智能工作流，用于代码审查和数据同步。然而，这种集成引入了新风险：攻击者可通过构造特定输入（如GitHub Issue评论），操控LLM代理执行非授权操作，如凭据泄露和任意命令执行。目前尚无学术研究系统探讨此类风险。本文提出首个检测与利用框架JAW，通过一种名为“上下文锚定演化”的新方法，劫持托管于自动化平台的智能工作流。核心思想是在混合程序分析生成的上下文约束下，演化工作流输入以达成攻击目的。JAW通过三项分析构建代理上下文：(i) 静态路径可行性分析，识别可触发的代理调用路径及其输入约束；(ii) 动态提示溯源分析，追踪输入如何被转换并嵌入LLM上下文；(iii) 能力分析，确定代理运行时可执行的操作与限制。对GitHub工作流和n8n模板的评估表明，共4714个GitHub工作流和8个n8n模板可被成功劫持，例如泄露用户凭据。影响涵盖15个广泛使用的GitHub Actions，包括Claude Code、Gemini CLI、Qwen CLI和Cursor CLI等官方Action，以及两个官方n8n节点。所有发现均已负责任披露，获GitHub、Google、Anthropic等厂商认可，并获得多项修复与漏洞赏金。
原文摘要 · Abstract (English)
Automation platforms such as GitHub Actions and n8n are increasingly adopting so-called agentic workflows, which integrate Large Language Model (LLM) agents for tasks such as code review and data synchronization. While bringing convenience for developers, this integration exposes a new risk: An adversary may control and craft certain inputs, such as GitHub issue comments, to manipulate the LLM agent for unwanted actions, such as credential exfiltration and arbitrary command execution. To our knowledge, no prior academic work has studied such a risk in agentic workflows. In this paper, we design the first detection and exploitation framework, called JAW, to hijack agentic workflows hosted on automation platforms via a novel approach called Context-Grounded Evolution. Our key idea is to evolve agentic workflow inputs under the contexts derived from hybrid program analysis for hijacking purposes. Specifically, JAW generates agentic workflow contexts through three analyses: (i) static path-feasibility analysis to identify feasible agent-invocation paths and the input constraints required to trigger them, (ii) dynamic prompt-provenance analysis to determine how that input is transformed and embedded into the LLM context, and (iii) capability analysis to identify the actions and restrictions available to the agent at runtime. Our evaluation of JAW on GitHub workflows and n8n templates showed that 4714 GitHub workflows and eight n8n templates can be successfully hijacked, for example, to leak user credentials. Our findings span 15 widely-used GitHub Actions, including official GitHub Actions for Claude Code, Gemini CLI, Qwen CLI, and Cursor CLI, and two official n8n nodes. We responsibly disclosed all findings to the affected vendors and received many acknowledgements, fixes, and bug bounties, notably from GitHub, Google, and Anthropic.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。