A newly disclosed set of critical security flaws affecting AI coding-agent workflows from Anthropic, Google, and OpenAI could allow unauthenticated attackers to weaponize malicious GitHub issues and trigger remote code execution (RCE), credential theft, persistent agent hijacking, or software supply chain compromise.
Novee Security researcher Elad Meged identified the vulnerabilities in default configurations used across the vendors’ own public repositories.
The findings underscore a growing risk in AI-assisted development environments, where coding agents are increasingly granted access to repositories, CI/CD workflows, command-line tools, writable workspaces, and sensitive credentials.
Critical AI Coding Agent Flaws
The core issue is not the underlying large language model itself, but the “agent harness” surrounding it. This includes permission policies, tool routing, sandboxing controls, shared workspace behavior, command validation, and execution environments.
In automated software-development workflows, coding agents can read GitHub issues, inspect code, run shell commands, modify files, and access workflow secrets.
Every interaction between these components creates a potential trust boundary. In the reported cases, attacker-controlled text crossed those boundaries with more authority than intended.
The demonstrated attack path begins with an untrusted GitHub issue, pull-request comment, or workflow input containing a prompt-injection payload.
Once processed by an AI coding agent with tool access or write permissions, that payload can influence subsequent actions.
Depending on the environment, this may lead to arbitrary command execution, secret exposure, or malicious instructions that persist into later and more privileged agent runs.
Novee Security said it found similar patterns across more than 100 public repositories. Although the research focused on public GitHub Actions workflows, the underlying problem applies to any automation pipeline that processes externally controlled text without robust isolation.
Anthropic’s Claude Code Action reportedly contained multiple bypass paths involving permissive tool permissions and assumptions in command validation logic.
One reported scenario involved a broadly allowed git push command that Git could interpret in a way that resulted in code execution on the GitHub Actions runner.
Later findings allegedly enabled arbitrary file reads and the exposure of workflow secrets through reporting mechanisms and permitted web requests.
Credentials such as GITHUB_TOKEN and ANTHROPIC_API_KEY could potentially be exposed, allowing repository tampering if the available token had write-level permissions.
Anthropic addressed the issues through several fixes. The final disclosure round was assigned CVE-2026-54316, according to reporting on the research.
Google’s Gemini CLI issue combined two weaknesses: restrictions on a shell tool that were reportedly not enforced at runtime, and incomplete environment sanitization. While secrets were removed from a child process, they remained accessible in the parent process environment.
A compromised child process could reportedly inspect Linux process interfaces to recover credentials intended to be isolated. Combined with unrestricted command execution in an automated workflow, the flaw could enable repository takeover and malicious package publication.
Google rated the vulnerability CVSS 10.0 and introduced a breaking trust-model change for headless Gemini CLI execution and the run-gemini-cli GitHub Action.
OpenAI’s Codex flaw involved multi-stage workflows sharing a writable checkout. An initial agent processing untrusted input could create a malicious AGENTS.md file, which a later Codex run might load as trusted instructions. OpenAI hardened its workflow by isolating stages and using read-only environments.
Organizations deploying coding agents should isolate jobs, eliminate shared writable state, minimize token privileges, and treat every agent-readable file as untrusted input.
No Comment! Be the first one.