GitHub Issue Injection Flaws Exposed in AI Coding Agents

Novee Security disclosed at Black Hat USA 2026 that AI coding agents tied to GitHub workflows can be manipulated through untrusted issue, pull request, and workflow-generated content to execute malicious actions inside repositories they are meant to maintain. Testing of Anthropic Claude Code, Google Gemini CLI, and OpenAI Codex against the vendors’ own public repositories and default setups showed paths to remote code execution, credential theft, repository tampering, and software supply-chain compromise without requiring privileged access.

Researchers said the weakness lies primarily in the surrounding agent harnesses—tool permissions, execution controls, and sandboxing—rather than the underlying models. Reported exploitation paths included command-validation bypasses, unenforced shell restrictions, secret exposure through /proc, and persistent instruction poisoning across multi-pass workflows. Anthropic remediated CVE-2026-54316 in Claude Code versions 0.2.54 through 2.1.162; Google patched Gemini CLI versions before 0.39.1, preview versions before 0.40.0-preview.3, and run-gemini-cli GitHub Action versions before 0.1.22; OpenAI mitigated Codex workflow risk by isolating agent runs and using read-only environments. The researchers said they found similar insecure patterns in more than 100 public repositories and reported no evidence of malicious exploitation in the wild.