A GitHub issue filed by an account with no repository access was enough to run attacker code on the CI runners behind Anthropic’s, Google’s and OpenAI’s own coding agents. Novee Security disclosed the chain at Black Hat USA on August 5: Gemini CLI’s flaw is rated CVSS 10.0, Claude Code’s 9.1 on NVD, and all three products failed at the same seam between the agent’s validator and the shell.
Read the full story: One GitHub issue, RCE on Claude Code and Gemini CLI runners →
Transcript
A single GitHub issue, from an account with no write access, was enough to run code on the CI runners behind Anthropic's, Google's and OpenAI's own coding agents. Novee Security showed the whole chain at Black Hat. In Claude Code, the validator strips quoted text before it checks a command, so a payload hidden inside a git flag looked harmless, and git ran it anyway. In Gemini CLI, a crafted env file injected commands onto the host before the sandbox even started. That one scored a perfect ten. Codex needed no bug at all. The first pass writes an instructions file, and the second pass obeys it. None of this touched the model. It all broke in the layer between the model and the shell. Patch your agents, then go look at which workflows a stranger can trigger.