🟠 High | Source: The Hacker News
Security researchers at Novee Security demonstrated that simply opening a GitHub issue — without any repository access — was enough to trigger code execution on CI runners used by Anthropic’s Claude Code and Google’s Gemini CLI projects, exposing secrets held in those pipelines. OpenAI’s coding agent was similarly vulnerable, with the same technique able to hijack subsequent agent runs. The attacks exploited prompt injection flaws in AI coding agents operating in default, vendor-shipped configurations, meaning the risk applies broadly to any team adopting these tools as-shipped.
Security Architect’s Take: Audit any CI/CD pipelines that use AI coding agents — particularly Claude Code, Gemini CLI, or OpenAI’s agent — and ensure they run in isolated environments with least-privilege credentials and no access to secrets beyond what is strictly necessary. Treat untrusted input channels (issues, PRs, comments) as a prompt injection attack surface and restrict agent permissions accordingly until vendors ship hardened defaults.
Original advisory: Claude Code and Gemini CLI Flaws Let a GitHub Issue Reach CI Workflow Secrets