A Flaw in Claude Code: A GitHub Issue Reaches CI Secrets

A GitHub issue opened by someone with no rights to the repository was enough to reach the secrets of its build pipeline. Novee Security presented the finding at Black Hat USA on 5 August 2026, covering three AI coding agents at once: Anthropic's Claude Code, Google's Gemini CLI and OpenAI's Codex. None of the attacks broke a model. They broke the harness around it, the ordinary code that decides which commands the model is allowed to run.

How a GitHub Issue Reaches CI Secrets

All three agents are wired into continuous integration the same way. A repository event, an issue or a pull request, triggers a workflow, the workflow starts the agent on a runner, and the agent reads the event text as part of its task. That text is written by whoever opened the issue. On a public repository, that is anyone at all.

Prompt injection through such text is a known problem, and every one of these tools has a validation layer meant to contain it. The research is about the layer failing, not about the model being gullible. A runner holds the credentials the pipeline needs: repository tokens, cloud keys, the API keys of the agent itself. Whoever runs a command on the runner reaches all of it.

The Claude Code Vulnerability: A Quoting Mismatch and a Download Counter

The Claude Code chain started with a disagreement about quotes. The command validator stripped single-quoted text before applying its twenty-three security checks, on the assumption that a shell would treat the quoted content as inert data. The harness then passed the command on without those quotes. A value smuggled into git's --receive-pack flag therefore looked harmless during validation and executed on the runner.

What followed is the interesting part. Anthropic patched it, and the researchers found a second route using tac, a read-only command that reverses file contents, to print an API key backwards into a public build log. That was patched too. The third round, tracked as CVE-2026-54316, gave up on printing anything: it leaked the API key one character at a time by incrementing the public download counter of a Hugging Face model, reading the answer from outside. The flaw is rated 9.1 on CVSS v3.1 and 6.0 on CVSS v4, and Anthropic classifies it as moderate on the grounds that an attacker must first get untrusted content into the agent's context. Releases from 0.2.54 onwards were affected; the fix landed in 2.1.163, under advisory GHSA-fg94-h982-f3mm.

Gemini CLI: The Worst Score of the Three

Google's tool got the harsher rating. CVE-2026-12537 carries a CVSS of 10.0: the container launcher parsed its tool allowlist once, at registration, and enforced nothing at runtime. Under the --yolo flag every command the model requested was approved automatically, and OS command injection through a crafted .gemini/.env file ran code on the CI host before the sandbox even started. Every version through 0.39.0 was vulnerable; the fix is in 0.39.1, with the GitHub Action updated to run-gemini-cli 0.1.22 under advisory GHSA-wpqr-6v78-jr5g.

Codex came out differently. Two Codex passes shared one checkout in the same job, so the first pass could write an AGENTS.md file that the second pass then loaded as instructions. OpenAI's position is that the sandbox behaved exactly as documented, so no version patch was issued; the workflow guidance changed instead, splitting the passes into separate jobs and naming repository instruction files as part of the untrusted input surface.

Why the Stolen Access Keeps Working

A separate piece of research from Silverfort, published on 28 July 2026, explains why a single theft is worth so much. On macOS, Claude Code CLI writes its OAuth bundle into the Keychain as a generic password under the service name "Claude Code-credentials", created through /usr/bin/security with no access-control arguments. The item inherits the default access list, which trusts the tool that created it. Since that tool is a general-purpose Apple binary any process can call, a one-line command returns the whole bundle with no Touch ID prompt and no password.

The bundle holds a short-lived access token and a long-lived refresh token, plus credentials for connected MCP servers. The refresh token is the problem: it can be traded for new access tokens until somebody revokes it, and it is not bound to a device or an address. Anthropic does not classify this as a vulnerability, taking the position that processes running as the same user are already trusted, but has said it is tracking tighter access control as a hardening improvement. It is worth noting that the company's own desktop app does it the other way, storing tokens encrypted with a key bound to its code signature, which does produce a password prompt when anything else reaches for it.

What to Do If You Run These Agents

• Update first: Claude Code 2.1.163 or later, Gemini CLI 0.39.1 with run-gemini-cli 0.1.22. For Codex there is no patch to install, only a workflow change to make.
• Do not let public events trigger an agent: a workflow that starts on any issue or pull request from any account hands the input surface to strangers. Require a label, a maintainer's comment or a fork check.
• Scope the runner's secrets: give the job the narrowest token it can work with, and keep long-lived cloud keys out of workflows an agent can touch.
• Split the passes: if two agent runs share a checkout, the first can write the instructions the second obeys. Separate jobs, separate checkouts.
• Rotate on suspicion, not on proof: log out and log back in, then rotate console keys. Cleaning the endpoint does not invalidate a refresh token that has already left.
• Watch for the same session on two machines: credential replay across hosts is the signal these tokens make possible, because nothing binds them to the device that earned them.

Why This Matters Beyond Developers

The pattern here is the one that keeps repeating as agents get more autonomy: the attack does not arrive over the network as traffic you could inspect, it arrives as content, and it executes inside a session that is already trusted. We wrote about the same shape when an AI browser could be hijacked by a post the user never clicked, and it is the reason a chain like the WordPress login bug that ends in code on the server is dangerous despite needing an administrator to simply open a page. This is also where the honest limit of network privacy tools sits. A VPN hides your traffic from the network you are on and moves your apparent location; it has no view into what your own agent decides to execute, and it does not stand between a process and the keychain on the same laptop. Encryption in transit was never the boundary these attacks cross.

Conclusion