What happened
Security researchers found flaws in Claude Code, Gemini CLI, and Codex-driven CI workflows where untrusted content from a GitHub issue could reach CI pipelines, allowing exposure of API keys, execution of commands on the CI host, or manipulation of instructions consumed by the next agent run.
Why it matters
AI coding agents are increasingly wired directly into CI/CD pipelines with access to secrets and build hosts. A single crafted GitHub issue — content an external, unauthenticated user can typically post — can pivot into host command execution and credential theft, turning a routine coding-agent workflow into a supply-chain compromise vector.
Attack vector
Attacker posts a crafted GitHub issue; the coding agent ingests the issue content as part of its CI-triggered workflow, allowing untrusted input to reach shell execution or secret-bearing environment variables in the CI runner.
Affected systems
Claude Code, Gemini CLI, and Codex-based CI agent workflows
Mitigation
Treat all GitHub issue/PR content as untrusted input to agent-driven CI; sandbox CI runners invoked by agents, avoid exposing long-lived secrets to agent-triggered jobs, and add allow-listing/validation before agent output reaches shell execution.