A single GitHub issue could reach CI secrets across major AI coding agents

Novee Security showed at Black Hat that a GitHub issue opened by an account with no repository access could reach the CI runners behind major AI coding agents in their default configurations, tested against Claude Code, Gemini CLI, and Codex. The strongest, a Gemini CLI container-launcher command injection scored 10.0, runs code on the CI host before the sandbox starts. In Claude Code, a validator that stripped quoted text let a payload in a Git flag reach the runner, and a separate flaw leaked an API key through a download counter. Untrusted issue content reaching an agent that holds secrets and tools in the same runtime is the shared weakness.

Check

Update Gemini CLI to 0.39.1 and Claude Code to 2.1.163, and review any workflow where an AI agent runs automatically on issues or pull requests from untrusted users.

Affected

Teams running AI coding agents on public repositories in default configurations (CVE-2026-12537, CVE-2026-54316); an unprivileged GitHub issue or pull request can reach CI runners and expose workflow secrets and tokens.

Fix

Patch the agents, restrict their tools with allowlists rather than blocklists, give triage and review agents read-only tokens, and keep separate agent runs from sharing writable directories.