Opening a GitHub issue was enough to reach CI secrets in Claude Code and Gemini CLI

Novee Security presented findings at Black Hat USA on August 5, 2026 showing that a GitHub issue opened by an account with no repository privileges could execute code on the CI runners behind Anthropic's and Google's own coding-agent repositories, reaching workflow API keys and repository credentials. Gemini CLI before 0.39.1 carried CVE-2026-12537, a CVSS 10.0 command injection, fixed alongside run-gemini-cli 0.1.22. Claude Code 0.2.54 through 2.1.163 carried CVE-2026-54316, CVSS 9.1, an API key exfiltration path. OpenAI's Codex repository was affected through its workflow configuration and was addressed by separating CI jobs rather than by a version patch.

Why it matters

Agent tooling has quietly inverted the trust model of CI. A GitHub issue is untrusted input from anyone on the internet, and pointing an agent at it inside a runner that holds secrets makes that input executable. The same applies to repository instruction files, pull request titles, and commit messages: if the agent reads it, treat it as attacker-controlled. The mitigations are boring and effective. Separate CI jobs so untrusted-input passes never share a runner with credentialed steps, run agents in read-only sandboxes without sudo, run them as the final pipeline step so no privileged process follows them, and scope workload identity tokens to the single repository and action that needs them rather than issuing an org-wide key.

Source: The Hacker News