What Happened
A GitHub issue opened by an account with no repository privileges was enough to execute code on the CI runners behind Anthropic's and Google's own coding-agent repositories. On OpenAI's, it was enough to hijack the next agent run. Novee Security ran the attack against each vendor's agent in the configuration that the vendor ships by default, and presented the work at Black Hat USA on August 5.
Why It Matters
The reported issue describes a GitHub issue or other attacker-controlled GitHub content being interpreted by coding agents in CI, allowing unprivileged users to trigger code execution or secret access in vendor-shipped default configurations. The article says Novee Security demonstrated the attack against Anthropic’s Claude Code and Google’s Gemini CLI, and that similar behavior affected OpenAI’s agent run flow. RealGround analysis: this is a high-priority prompt-injection and agent-abuse risk because the exploit path crosses from untrusted repository metadata into CI workflows that hold secrets, so workflows that ingest GitHub content should be audited and red-teamed for input trust boundaries.
RealGround Analysis
This signal maps to prompt injection. Organizations using AI agents, LLM APIs, SaaS integrations, or sensitive data workflows should review whether this class of issue could create unauthorized tool execution, data leakage, weak approval gates, or unmanaged supply-chain exposure.
Recommended Actions
- Restrict AI agent tool permissions and production write paths.
- Review sensitive data access across prompts, logs, embeddings, memory, and SaaS integrations.
- Add human approval workflows for high-impact or state-changing actions.
- Run prompt injection and indirect prompt injection tests against affected workflows.
- Document the owner, control gap, and remediation deadline for this risk class.
Source
https://thehackernews.com/2026/08/claude-code-and-gemini-cli-flaws-let.html