Recoleta
GitHub
Source note

Comment and Control: Hijacking Agentic Workflows via Context-Grounded Evolution

Authors
Neil Fendley, Zhengyu Liu, Aonan Guan, Jiacheng Zhong, Yinzhi Cao
Source
arXiv
Published
Collection
Software Intelligence
Agentic WorkflowsPrompt InjectionWorkflow SecurityLLM AgentsGithub Actions
Open arXivMarkdown source

Summary

JAW finds and exploits hijackable LLM-agent workflows in GitHub Actions and n8n by combining workflow path analysis, runtime prompt tracing, capability probing, and payload evolution. The paper claims 4,174 hijackable GitHub workflows and 8 hijackable n8n templates, including cases that leak credentials.

Problem

  • Agentic workflows put attacker-controlled content, such as GitHub issue comments, into prompts for agents that may hold tokens, secrets, shell tools, APIs, or database access.
  • Existing workflow scanners miss feasible agent-invocation paths and runtime prompt behavior; jailbreak work often assumes the attacker controls the full prompt, which does not match workflow templates.
  • This matters because an outside user can steer a trusted workflow agent into credential exfiltration, unauthorized data access, or unwanted service requests.

Approach

  • JAW builds a Guarded Workflow Graph across workflow YAML, shell, JavaScript, Python, reusable actions, and n8n nodes, then solves path constraints to produce an event that reaches an agent call.
  • It runs the workflow with canary-marked attacker fields and traces how those fields are transformed and inserted into the final model request.
  • It profiles the agent's available tools and limits, such as command allowlists, path rules, sandboxing, environment filtering, and output channels.
  • It evolves payloads against the recovered trigger conditions, prompt context, and tool limits so the same input can trigger the agent and drive an executable action chain.

Results

  • On real-world GitHub workflows and n8n templates, JAW found 4,174 hijackable GitHub workflows and 8 hijackable n8n templates.
  • The findings covered 15 widely used GitHub Actions, including official actions for Claude Code, Gemini CLI, Qwen CLI, and Cursor CLI.
  • The findings also covered 2 official n8n nodes.
  • Reported impacts include credential leakage and arbitrary command execution when the agent has suitable runtime access.
  • Vendors acknowledged and fixed multiple reports; the paper names GitHub, Google, Anthropic, and Snowflake as sources of bug bounties or acknowledgements.

Link