Home » Software Dev » One GitHub issue can drain CI secrets from Claude Code, Gemini CLI, and Codex

One GitHub issue can drain CI secrets from Claude Code, Gemini CLI, and Codex

Cagri Sarigoz

Published August 14, 2026

If your team runs AI coding agents inside GitHub CI, this one belongs on your radar today. Security researchers at Black Hat demonstrated how a single GitHub issue, filed by an account with zero repository access, could expose workflow secrets in the CI pipelines of Claude Code, Gemini CLI, and OpenAI Codex.

The Two CVEs

Two distinct vulnerabilities were disclosed, both patched by their respective vendors.

• CVE-2026-12537 (CVSS 10, HIGH): Affects Google Gemini CLI versions prior to 0.1.22 of the run-gemini-cli GitHub Action and versions prior to 0.39.1 of Gemini CLI itself. A maliciously crafted .gemini/.env file triggered OS command execution on the CI host before the sandbox could initialize. An unprivileged attacker could reach host-level code execution through this path. Google has patched both the CLI and the Action.
• CVE-2026-54316 (CVSS 6, HIGH): Affects Claude Code from version 0.2.54 up to but not including 2.1.163. The hostname huggingface.co was pre-approved as a bare hostname for Claude Code’s WebFetch tool, meaning any path on that domain, including attacker-controlled model repositories, was auto-approved without a permission prompt. An attacker who could inject content into a Claude Code context window could direct it to fetch attacker-controlled files on Hugging Face. Because Hugging Face counts those fetches as downloads server-side, this created a covert channel for encoding and exfiltrating data Claude could access: files, environment variables, and command output. Anthropic fixed this in version 2.1.163.

‍ The Wider Pattern

These two CVEs are not isolated. Earlier research by Aonan Guan, published in April, demonstrated that prompt injection through pull request titles, issue bodies, and hidden HTML comments could hijack Claude Code Security Review, Gemini CLI Action, and GitHub Copilot Agent. The Black Hat findings extend that same attack surface.

The structural problem is the CI harness itself. AI coding agents are designed to act autonomously on repository events. That autonomy becomes a liability when the input, a GitHub issue or PR body, can carry attacker-controlled content into the agent’s context window before any permission check fires.

What to Do Now

• Update Gemini CLI to version 0.39.1 or later and the run-gemini-cli GitHub Action to version 0.1.22 or later.
• Update Claude Code to version 2.1.163 or later.
• Audit every externally triggered pipeline that runs an AI coding agent. Treat any input from GitHub issues, PR titles, or comments as untrusted content.
• Review which hostnames your AI tools have pre-approved for network access without a permission prompt.

Vendors patched quickly, but the underlying harness design flaw is not unique to these two tools. Any agentic workflow that processes external GitHub events is a candidate for the same class of attack.

Cagri Sarigoz( Founder )

I’m founder of BizStack at Cagri Sarigoz LLC and a passionate advocate for entrepreneurs.

With over 14 years in tech, marketing, and AI, including my role as Head of SEO at CitizenShipper and co-founder of TaleBot at Intale AI, I’m dedicated to sharing genuine, useful product insights and tips.

At BizStack, I aim to cut through the digital noise to provide clear, actionable advice.

And more than all else, I’m a father to a (always) little girl and a husband.

Contact me at [email protected] for assistance.