By ByteBot
A stranger opens a GitHub issue on your public repo. No permissions, no fork, no special access — just a text field and a submit button. Your AI coding agent reads the issue as part of a routine CI workflow, and within seconds, your ANTHROPIC_API_KEY and GITHUB_TOKEN are in someone else’s hands. This is not a thought experiment. Novee Security’s Elad Meged demonstrated it live at Black Hat USA 2026, and it hit Claude Code, Gemini CLI, and OpenAI Codex in one sweep.
One GitHub Issue, Three Victims
The attack starts with something any user can do: open a GitHub issue. Meged crafted an issue body containing a prompt-injection payload that rode through the AI agent’s issue-processing workflow into the CI runner. The runner held everything — workflow secrets, API tokens, push access. The agent delivered them faithfully because it was designed to be helpful, and nobody told the harness to stop trusting public input.
In Claude Code’s case, the attack exploited Action tag mode. A valid-looking git push command carried a Git flag with a quoted value that command validators read as benign but Git itself later executed. That execution reached the runner environment, where GITHUB_TOKEN and ANTHROPIC_API_KEY were sitting in plain environment variables. The credentials were then exfiltrated using Hugging Face’s public model download counter as a covert channel — leaking the API key one character at a time in what looked like routine model traffic. This is CVE-2026-54316, fixed in Claude Code 2.1.163.
Gemini CLI Scored a Perfect 10
The most technically alarming finding is CVE-2026-12537 in Gemini CLI, which received a perfect CVSS v4 score of 10.0. In headless CI mode, Gemini CLI automatically trusted any workspace directory and loaded .gemini/.env configuration files without requiring explicit authorization — and it did this before the sandbox started. An attacker with write access to the repo could plant a crafted .env file that injected OS commands at startup, before any security layer had a chance to intercept them.
The fix required a fundamental change: upgraded versions now demand explicit workspace authorization before reading any configuration. The patched versions are Gemini CLI 0.39.1 and run-gemini-cli 0.1.22. If your CI pipeline uses either and has not updated, it is currently exploitable.
OpenAI Said the Sandbox Worked as Intended
Codex was part of the same attack chain, but OpenAI’s response was jarring: no CVE, no patch version, no acknowledgment of a bug. Their official position is that the sandbox “behaved exactly as documented.” The security research community was not impressed. When documented behavior includes exfiltrating CI secrets through a public GitHub issue, the documentation is the problem. There is a difference between intended behavior and acceptable behavior, and vendors conflating the two to avoid a patch cycle erodes developer trust.
The Model Is Not the Problem
Here is what gets missed when this is framed as an “AI security” story: the models did nothing wrong. Claude, Gemini, and GPT-4o processed inputs and produced outputs consistent with their training. The vulnerability was in the harness — the surrounding infrastructure managing tool permissions, execution context, file system access, trust levels, and sandbox boundaries. The harness is what most teams write themselves, in GitHub Actions YAML files and shell scripts, without a security review.
Check Point Research raised the same structural issue in February 2026, when they disclosed CVE-2025-59536 and CVE-2026-21852 — both exploiting Claude Code’s project configuration files (hooks, MCP server configs, ANTHROPIC_BASE_URL redirect). The pattern is consistent across six months of disclosures: developers are giving AI agents access to production secrets inside configuration files that anyone submitting a pull request can influence.
What to Do Right Now
The patch versions are not optional:
- Claude Code: Update to 2.1.163 or later
- Gemini CLI: Update to 0.39.1 or later
- run-gemini-cli GitHub Action: Pin to 0.1.22 or later
- Codex: No patch available — audit your workflow manually
Beyond patching, the GitHub Agentic Workflow security architecture guide lays out the right model: agents isolated in dedicated containers, credentials routed through trusted proxies outside agent boundaries, logging at every trust boundary. The core rule is simple — treat AI coding agents as untrusted contributors, not automated maintainers with implicit trust. Never let a public issue be the sole trigger for code that runs with repository secrets. Separate agents that read from agents that write. Minimize token scope to exactly what each task requires.
The industry moved fast building these workflows. The security thinking is catching up. The developers maintaining AI-powered CI/CD pipelines need to treat the harness as security-critical infrastructure — because someone who only has a GitHub account and five minutes already knows it is.
