AI Coding Agents from Google, Anthropic, and OpenAI Vulnerable to CI/CD Hijacking
Researchers demonstrate how simple GitHub issues can lead to remote code execution and secret theft in agentic workflows.
Security researchers from Novee Security have demonstrated that attackers can compromise the CI/CD pipelines of Google, Anthropic, and OpenAI by simply opening a GitHub issue. By exploiting flaws in how AI coding agents handle untrusted input, the team achieved remote code execution (RCE) and stole sensitive workflow secrets.
The vulnerabilities were identified in default configurations running on the vendors' own public repositories. Among the most severe was a flaw in Google's Gemini CLI (GHSA-wpqr-6v78-jr5g), which received a critical CVSS score of 10.0. In Anthropic's Claude Code (CVE-2026-54316), researchers found an out-of-band data exfiltration vulnerability. This flaw utilized a pre-approved HuggingFace domain within the agent's WebFetch tool to bypass security restrictions and steal API keys. OpenAI's Codex was found to have a shared workspace vulnerability; an attacker could use an initial agent pass to write an AGENTS.md file, which a subsequent, more privileged agent pass would then execute as instructions.
The Agentic Trust Gap
AI coding agents are increasingly integrated into CI/CD pipelines to automate the handling of bug fixes and feature requests. These agents typically operate within a "harness"—a structured environment of permissions, tools, and sandboxes designed to limit their impact. However, the Novee Security research reveals a systemic gap in how these systems manage trust.
The vulnerability arises when there is a disconnect between how one component validates input and how a subsequent component executes it. When an agent labels untrusted input as "safe," a following process may treat that input as "trusted," creating a window for attackers to inject malicious commands. As Novee Security noted via GBhackers, any files created by an agent that handles untrusted content must themselves be treated as untrusted input.
Supply Chain Implications
This research signals a shift in the risk profile of Large Language Models (LLMs). Prompt injection is no longer limited to tricking a chatbot into ignoring its rules; it has evolved into a vector for full supply-chain compromise. Because these agents often possess write access to repositories, a successful manipulation via a public GitHub issue allows an attacker to inject malicious code directly into production software.
By bypassing traditional human review processes, these vulnerabilities allow for the silent exfiltration of GITHUB_TOKENs and other critical secrets. The ability to hijack the automated pipeline means that the very tools designed to increase developer velocity are now potential backdoors into the heart of the software development lifecycle.
The Path Forward
While the vendors have been alerted to these flaws, the research highlights the need for a "zero trust" architecture for AI agents. Security teams must now consider how to isolate agentic workspaces and implement stricter validation for any files generated by AI before they are processed by privileged system components. The industry must now determine if the efficiency of automated AI coding outweighs the risk of introducing an unmonitored, programmable entry point into the production pipeline.