Claude Code and Gemini CLI Flaws Let a GitHub Issue Reach CI Workflow Secrets

What happened

Security researchers at Novee Security found serious flaws in the CI/CD workflows of Claude Code and Google’s Gemini CLI repositories. By opening a GitHub issue from an account without any repository privileges, attackers could execute arbitrary code on the CI runners used by Anthropic and Google. For OpenAI’s coding agent, the same trick could hijack an agent run triggered by those workflows. The researchers tested attacks against each vendor’s default configurations and unveiled their findings at Black Hat USA on August 5.

The risk

These weaknesses expose critical secrets and internal infrastructure through continuous integration workflows. Since CI runners often have access to sensitive credentials and can trigger automated processes, unauthorized code execution creates a direct path for attackers to steal secrets, manipulate builds, or implant malicious code. The flaw does not require elevated GitHub privileges, meaning anyone capable of opening an issue can trigger the exploit. This lowers the barrier for attackers to compromise AI coding agents’ codebases and pipelines.

Why it matters

This breach undermines trust in popular AI development tooling from leading vendors. Builders relying on these tools to maintain and deploy coding agents must reassess their CI permissions and environment isolation. The default out-of-the-box configurations proved vulnerable, signaling a need for stronger safeguards across open-source AI infrastructure. Organizations embedding AI agents into development pipelines face increased risks of insider-style attacks through endpoint misconfigurations. This raises the cost and complexity of securely integrating AI agents into software workflows.

Who should pay attention

Developers and DevOps teams deploying or contributing to AI coding-agent projects must review their CI setups immediately. Security teams working with AI development pipelines must prioritize vetting access controls on repository interactions triggered automatically by GitHub issues or pull requests. Founders and product leads at companies using Anthropic, Google, or OpenAI AI coding agents should audit these dependencies and plan mitigation strategies. Investors and buyers of AI tools should demand proof of secure software supply chain practices to avoid risky exposures.

What to watch next

Watch for vendor-issued patches or configuration guidance to close these vulnerabilities. Check if repositories shift toward stricter permission models or more robust runner isolation practices. Expect broader scrutiny around AI development environments as attacks move beyond models into the developer tooling layer. Security researchers will likely target other AI toolchains for similar CI workflow weaknesses. Staying alert to updates from Anthropic, Google, and OpenAI on remediation timelines is critical for operational security.

AI Quick Briefs Editorial Desk