A Simple GitHub Issue Just Exposed CI Secrets in Claude Code and Gemini CLI

Robert Moore · 2026-08-07

You'd think that breaking into a major AI company's development pipeline would require some serious hacking skills. Maybe a zero-day exploit, some social engineering, or at least a few sleepless nights staring at a terminal. But according to new research from Novee Security, all it took was a GitHub issue opened by an account with zero repository privileges. That's right. No special access. No insider knowledge. Just a well-crafted issue that managed to execute code on the CI runners behind Anthropic's and Google's own coding-agent repositories. And on OpenAI's setup, the same attack was enough to hijack the very next agent run. ### The Attack That Started With a Simple Issue Novee Security presented these findings at Black Hat USA on August 5, and the implications are pretty staggering. The researchers ran the attack against each vendor's agent exactly the way the vendor ships it by default. No custom configurations, no tweaking the environment to make things easier. Just the default setup that every user gets. What they found was that the trust boundary between external input and internal CI workflows is thinner than most of us assumed. A GitHub issue, which is basically just a public comment box, became the entry point for code execution on the backend infrastructure that powers some of the most talked-about AI coding tools on the market. ### Why This Matters for Anyone Using AI Coding Agents If you're using Claude Code, Gemini CLI, or OpenAI's coding agents, this research should make you pause. These tools are designed to read code, modify files, and execute commands. That's their whole job. But when an attacker can influence what those tools do through something as innocuous as a GitHub issue, the attack surface gets a whole lot bigger. Here's what makes this particularly concerning: - The attack requires no authentication or special permissions on the target repository - It works with the default configuration that vendors ship to every user - It targets the CI/CD pipeline, which is where secrets like API keys and deployment credentials live - The same fundamental flaw appears across multiple major vendors ### The Bigger Picture: Trusting Your Tools The core issue here isn't just about GitHub issues or CI runners. It's about how much trust we place in automated systems that process untrusted input. When you connect an AI coding agent to your repository, you're giving it a lot of power. And if that agent has a flaw that lets someone else pull the strings, you're exposing your entire development workflow. For individual developers and small teams, this might seem like a distant problem. After all, who's going to target your small project with a sophisticated CI attack? But the reality is that these attacks aren't sophisticated. They're simple enough that a bored teenager with too much time could probably replicate them. ### What You Can Do Right Now While the vendors work on fixing these vulnerabilities, there are a few practical steps you can take to reduce your risk: - Review the permissions your CI workflows have and strip away anything they don't absolutely need - Use separate accounts and tokens for CI processes, and rotate them regularly - Be cautious about which repositories you allow to trigger automated workflows - Monitor your CI logs for unusual activity, especially around issue comments and PRs ### The Takeaway This research is a reminder that the tools we use to build software are only as secure as their weakest link. And sometimes, that weakest link is something as simple as a public comment box. The fact that Novee Security was able to pull this off against three of the biggest names in AI development should be a wake-up call for the entire industry. Whether you're a solo developer or part of a large team, it's worth taking a hard look at how your CI/CD pipelines handle external input. Because if a GitHub issue can reach CI workflow secrets, then nothing is really off-limits. Stay safe out there, and don't assume your default configuration is secure just because it's the default. Sometimes, the most dangerous assumption is the one you never think to question.