2026-03-23 · 2026-Q1
Checkmarx KICS GitHub Actions Compromise
Outside the model: Adjacent ecosystemAgent tooling was not the attack surface, so no layer applies.
- Fixable
- Vendor patch
- Vendor response
- Unknown
- In the wild
- Yes
- Actor
- Not applicable
Target
Checkmarx KICS, AST GitHub Action, OpenVSX extensions
Impact
35 tags hijacked; credential stealer exfiltrated secrets encrypted to attacker server checkmarx.zone
Root cause
cx-plugins-releases service account compromised via credentials from Trivy attack
Sources
Catalog
Cite this: AgentProv incident record: Checkmarx KICS GitHub Actions Compromise (2026-03-23). https://agentprov.com/incidents/2026-03-23-checkmarx-kics-github-actions-compromise