Security researchers at Novee Security identified critical workflow injection vulnerabilities in Claude Code, Google's Gemini CLI, and OpenAI's agent repositories. The flaws allow attackers to execute arbitrary code on CI runners and hijack agent executions using nothing more than a GitHub issue opened from an unprivileged account.
The attack exploits how each vendor's default CI/CD configuration processes GitHub issue data. When a user creates a public issue, the agent repositories automatically fetch and process the issue content as part of their workflows. Novee Security demonstrated that specially crafted issue content can break out of intended execution contexts and inject malicious commands into the CI pipeline.
For Anthropic's Claude Code and Google's Gemini CLI, the vulnerability enables remote code execution on CI runners. This grants attackers direct access to the build environment, secrets management systems, and artifact storage. For OpenAI's agent, the impact differs but remains severe. the flaw allows attackers to hijack the next scheduled agent run, potentially compromising subsequent operations and outputs.
All three vendors ship their agent repositories with default configurations that enable this behavior. No authentication beyond creating a public GitHub issue is required. An attacker needs only a GitHub account with no special permissions to the target repository.
Novee Security presented this research at Black Hat USA on August 5, providing detailed technical analysis of the vulnerability chain. The attack sequence is straightforward. First, create a GitHub issue in the target repository. Second, embed malicious commands in the issue description using syntax that breaks out of safe parsing contexts. Third, wait for the automated CI workflow to process the issue. Fourth, gain execution.
The vulnerability class represents a fundamental design flaw in how CI/CD systems trust external input sources. Treating GitHub issues as safe data sources without sanitization creates a direct attack surface for unauthenticated users.
Organizations running similar agent repositories should immediately audit