Executive Summary
Novee Security showed a GitHub issue from an account with no privileges could run code on CI runners behind Anthropic's and Google's coding-agent repositories and hijack the next agent run on OpenAI's, using each vendor's default configuration.
What Happened
A GitHub issue opened by an account with no repository privileges was enough to execute code on the CI runners behind Anthropic's and Google's own coding-agent repositories. On OpenAI's, it was enough to hijack the next agent run. Novee Security ran the attack against each vendor's agent in the configuration that the vendor ships by default, and presented the work at Black Hat USA on August 5.
Affected Products
- Claude Code
- Gemini CLI
- OpenAI Codex
Vulnerability / Attack Technique
Prompt injection via GitHub issues reaching CI secrets
Technical Mechanism
Coding agents in CI read issue content, followed injected instructions and executed code with access to workflow secrets.
AI Security Category
LLM01:2025 Prompt Injection
Part of the Prompt Injection topic.
Relevant Frameworks
RealGround Analysis
Default configurations were vulnerable even at the vendors' own repos. RealGround analysis: CI coding agents triggered by public issues must not have secrets.
Recommended Controls
- Do not run coding agents on public issues with access to secrets
- Require maintainer approval before agent runs on external input
- Rotate CI secrets exposed to agent workflows
Related RealGround Service
AI Agent Business Logic Audit · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/08/claude-code-and-gemini-cli-flaws-let.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.