Claude Code and Gemini CLI Flaws Let a GitHub Issue Reach CI Workflow Secrets
Article summary
Quick briefing — cleaned from the original RSS feed
A GitHub issue opened by an account with no repository privileges was enough to execute code on the CI runners behind Anthropic's and Google's own coding-agent repositories. On OpenAI's, it was enough to hijack the next agent run. Novee Security ran the attack against each vendor's agent in the configuration that the vendor ships by default, and presented the work at Black Hat USA on August 5.
1Key Takeaways
- A GitHub issue opened by an account with no repository privileges was enough to execute code on the CI runners behind Anthropic's and Google's own coding-agent repositories.
- On OpenAI's, it was enough to hijack the next agent run.
- Novee Security ran the attack against each vendor's agent in the configuration that the vendor ships by default, and presented the work at Black Hat USA on August 5.
2AIWedia Score
9.6/10
Must-read — high impact for AI builders
Based on source trust, recency, category impact, and story depth.
3Why it matters
LLM news directly affects chatbots, copilots, and APIs that millions of products rely on. The Hacker News reports that a GitHub issue opened by an account with no repository privileges was enough to execute code on the CI runners behind Anthropic's and Google's own coding-agent repositories.
Explore related
Browse toolsRelated tools
LLMs news
Explore curated llms tools on AIWedia — compare, rank, and launch from our directory.
Full story on The Hacker News
Read full articleHeadlines aggregated via RSS for discovery on AIWedia. Original content © The Hacker News. We link to the source and do not republish full articles.