# Opening a GitHub issue was enough to reach CI secrets in Claude Code and Gemini CLI

Source: https://startwithidentity.com/blog/2026-08-07-coding-agent-flaws-let-a-github-issue-reach-ci-secrets/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

Novee Security presented findings at Black Hat USA on August 5, 2026 showing that a GitHub issue opened by an account with no repository privileges could execute code on the CI runners behind Anthropic's and Google's own coding-agent repositories, reaching workflow API keys and repository credentials. Gemini CLI before 0.39.1 carried CVE-2026-12537, a CVSS 10.0 command injection, fixed alongside run-gemini-cli 0.1.22. Claude Code 0.2.54 through 2.1.163 carried CVE-2026-54316, CVSS 9.1, an API key exfiltration path. OpenAI's Codex repository was affected through its workflow configuration and was addressed by separating CI jobs rather than by a version patch.

## Why it matters

Agent tooling has quietly inverted the trust model of CI. A GitHub issue is untrusted input from anyone on the internet, and pointing an agent at it inside a runner that holds [secrets](https://startwithidentity.com/glossary/secrets-management/) makes that input executable. The same applies to repository instruction files, pull request titles, and commit messages: if the agent reads it, treat it as attacker-controlled. The mitigations are boring and effective. Separate CI jobs so untrusted-input passes never share a runner with credentialed steps, run agents in read-only sandboxes without sudo, run them as the final pipeline step so no privileged process follows them, and scope [workload identity](https://startwithidentity.com/glossary/workload-identity/) tokens to the single repository and action that needs them rather than issuing an org-wide key.

Source: [The Hacker News](https://thehackernews.com/2026/08/claude-code-and-gemini-cli-flaws-let.html)