Zero‑privilege accounts can trigger code execution on CI runners
A GitHub issue opened by an account without repository privileges was enough to run code on CI runners behind Anthropic’s and a major vendor’s coding‑agent repositories, revealing secrets and hijacking subsequent runs.
A single GitHub issue opened by an account that had no rights to the target repositories was sufficient to trigger code execution on the continuous‑integrations runners used by Anthropic and a leading coding‑agent vendor.
The flaw was traced to the way the Claude and Gemini command‑line interfaces parsed user input, allowing arbitrary shell commands to be injected into the workflow.
When the issue was created, the CI system pulled the agent’s repository, merged the new issue into the workflow definition, and ran the injected commands on the runner.
The attackers were able to read environment variables, access stored secrets, and in some cases, modify the agent’s next run.
Novee Security replicated the attack against each vendor’s default configuration, demonstrating the same vulnerability in Anthropic’s, Google’s, and the vendor’s agents.
On Anthropic’s and Google’s repositories, the injected commands executed on the runners and exposed sensitive data stored in the workflow.
On the vendor’s platform, the injected code hijacked the next agent run, effectively taking control of the execution pipeline.
The breach highlighted that even accounts without repository permissions can influence CI workflows when the parsing logic is weak.
The incident underscores the need for stricter input validation and the principle of least privilege in CI systems.
Novee Security presented the full findings at Black Hat USA on August 5, detailing the attack vector and remediation steps.
Both Anthropic and the vendor have acknowledged the issue and released patches that sanitize issue content before it is merged into the workflow.
Google has also updated its coding‑agent repository to reject malicious inputs from untrusted accounts.
Developers are advised to review their CI configurations, enforce strict permission checks, and audit logs for unusual issue activity.
A single GitHub issue opened by an account that had no rights to the target repositories was sufficient to trigger code execution on the continuous‑integrations runners used by Anthropic and a leading coding‑agent vendor.
The flaw was traced to the way the Claude and Gemini command‑line interfaces parsed user input, allowing arbitrary shell commands to be injected into the workflow.
When the issue was created, the CI system pulled the agent’s repository, merged the new issue into the workflow definition, and ran the injected commands on the runner.
The attackers were able to read environment variables, access stored secrets, and in some cases, modify the agent’s next run.
Novee Security replicated the attack against each vendor’s default configuration, demonstrating the same vulnerability in Anthropic’s, Google’s, and the vendor’s agents.
On Anthropic’s and Google’s repositories, the injected commands executed on the runners and exposed sensitive data stored in the workflow.
On the vendor’s platform, the injected code hijacked the next agent run, effectively taking control of the execution pipeline.
The breach highlighted that even accounts without repository permissions can influence CI workflows when the parsing logic is weak.
The incident underscores the need for stricter input validation and the principle of least privilege in CI systems.
Novee Security presented the full findings at Black Hat USA on August 5, detailing the attack vector and remediation steps.
Both Anthropic and the vendor have acknowledged the issue and released patches that sanitize issue content before it is merged into the workflow.
Google has also updated its coding‑agent repository to reject malicious inputs from untrusted accounts.
Developers are advised to review their CI configurations, enforce strict permission checks, and audit logs for unusual issue activity.