Gemini CLI, Claude Code, Codex Hijacked via GitHub Issues

Security researchers demonstrated that a single public GitHub issue, filed by someone with no write access to a repository, could turn AI coding agents from Anthropic, Google, and OpenAI against the projects they were set up to maintain. The finding comes from Novee Security, presented at Black Hat USA 2026, which tested Claude Code, Gemini CLI, and Codex against the vendors' own repositories using default workflow settings. It matters because these AI coding agents now run unattended inside CI pipelines, where they read issues and pull requests, run shell commands, edit code, and hold tokens that reach source and secrets. Google rated the Gemini CLI variant critical, with a CVSS score of 10.0. There is no public evidence of exploitation in the wild yet. This is a demonstrated attack class, not a live campaign.

What happened

According to the Novee Security research, the team looked at the routine automation people build around coding agents. These are workflows that read a GitHub issue or pull request and then do something useful, such as flagging duplicate reports, reviewing code, or managing the repository. That input is attacker controlled. Anyone can open an issue on a public project.

The researchers found that carefully written issue text could push the agents past their intended boundaries. The paths they reached included remote code execution, credential theft, repository modification, and instructions that survived from one agent run to the next. In each case the trigger was untrusted content that the agent read as part of a task it was told to perform.

The underlying problem is not new. If a pipeline feeds untrusted text into a system that can run code, the untrusted text can influence what code runs. What is new is the surface. A coding agent reads natural language, holds real permissions, and often runs without a person checking each step. That combination turns a prompt injection into an execution primitive.

Timeline

• Black Hat USA 2026: Novee Security presents the research, with working paths against Claude Code, Gemini CLI, and Codex on the vendors' own repositories and default configurations.
• Same window: Google publishes an advisory for Gemini CLI, rates it critical at CVSS 10.0, and ships fixed versions.
• Affected Gemini CLI builds are versions before 0.39.1, preview versions before 0.40.0-preview.3, and the run-gemini-cli GitHub Action before 0.1.22.

Exact per-vendor disclosure dates were not spelled out in the reporting we reviewed, and no CVE identifier was included in it. Treat the fixed versions above as the authoritative markers for the Gemini CLI issue.

Who is affected

The people most exposed are teams that run these agents in headless workflows against untrusted input. That means automation triggered by public issues or by pull requests from outside contributors, where no human approves the agent's actions before they run.

For Gemini CLI, Google scoped the impact to headless workflows that process untrusted content under the affected settings. If you pin the run-gemini-cli GitHub Action in a workflow that reads external issues, you are in scope until you upgrade. Codex users are affected where an issue triage or deduplication workflow runs agents in a shared, writable workspace. Claude Code users are affected through the same general pattern, where the agent reads untrusted content and holds tools that can run commands or write to the repository.

Local, interactive use with a human in the loop is a different risk profile. The demonstrated problem centers on automated, unattended runs on content an attacker can supply.

How the attack works

The general mechanism is prompt injection with consequences. The agent reads an issue as data, but the model treats parts of that text as instructions. Because the agent also has tools (a shell, git, the GitHub API), an instruction can become an action.

Google's case started with a tool restriction that appeared to permit only two things: an echo command and a command to view a GitHub issue. Novee found that Gemini CLI registered the full shell tool without enforcing that command-specific restriction at execution time. In practice the restriction looked tight in configuration but did not hold when the tool actually ran, which opened the door to arbitrary commands.

OpenAI's Codex case shows a quieter failure. Its issue deduplication workflow ran two agents inside the same writable workspace. The first agent could be manipulated into creating an AGENTS.md file, which Codex automatically reads as project instructions on its next run. When the second agent started, it accepted that attacker-written file as trusted guidance. The workflow checked and rejected the first agent's direct output, but the planted instruction file carried the influence forward anyway. That is persistence across runs, achieved through a file the tool trusts by design.

The Claude Code findings fall into the same family: untrusted issue content reaching an agent that holds enough capability to run code, steal credentials, or change the repository. The specific mechanics differ per tool, but the shape is consistent.

How to check if you are affected

Start by finding where agents run on untrusted input. Search your workflows for the affected action and for agent invocations tied to issue or pull request events.

# Find run-gemini-cli usage and its pinned version
grep -rn "run-gemini-cli" .github/workflows/

# Find workflows triggered by issues or external pull requests
grep -rEn "on:|issues:|issue_comment:|pull_request_target:" .github/workflows/

Check your installed Gemini CLI version against the fixed releases.

gemini --version
# Vulnerable: < 0.39.1  (preview: < 0.40.0-preview.3)
# Action run-gemini-cli vulnerable: < 0.1.22

Look for unexpected instruction files that an agent could have planted, since these are the persistence mechanism in the Codex case.

# Any AGENTS.md added in history, plus current instruction files
git log --all --diff-filter=A -- '*AGENTS.md'
find . -maxdepth 2 -iname 'AGENTS.md' -o -iname 'CLAUDE.md' -o -iname '.cursorrules'

If any of these workflows ran on public or externally authored content while on a vulnerable version, treat the run environment as suspect and review what tokens and secrets were reachable during those runs.

Remediation

Upgrade Gemini CLI and the Action first, then tighten how any agent is allowed to act on untrusted input.

# Gemini CLI: move to a fixed release (npm distribution)
npm install -g @google/gemini-cli@latest
gemini --version   # expect 0.39.1 or newer

Pin the run-gemini-cli GitHub Action to 0.1.22 or newer, and prefer pinning by full commit SHA rather than a floating tag so a later tag move cannot pull an older build. Do the same for any third party action in these workflows.

Beyond patching, change the trust model:

• Do not run agents automatically on content from people outside the project. Gate agent runs behind a maintainer label or an approval step for external issues and pull requests.
• Give the agent's token the least privilege it needs. Set permissions: to read only where possible, and avoid placing long lived secrets in the agent's environment.
• Isolate agent workspaces. Do not share a single writable workspace between stages, and treat any file an agent writes (including AGENTS.md, CLAUDE.md, or workflow files) as untrusted on the next run.
• Constrain tools at the point of execution, not just in configuration. If a workflow only needs to read an issue, it should not be able to spawn a general shell.

These steps do not depend on any one vendor shipping a fix. They limit what an injected instruction can reach if another bypass appears.

FAQ

Is Gemini CLI safe to use now?

It is safe once you are on a fixed release. Google addressed the critical issue in Gemini CLI 0.39.1, preview 0.40.0-preview.3, and the run-gemini-cli GitHub Action 0.1.22. Versions before those remain vulnerable in headless workflows that process untrusted content, so upgrade and pin the Action.

How do I know if I am affected by the AI coding agent GitHub issue attack?

Check whether any workflow lets an agent act on issues or external pull requests without human approval, and confirm your Gemini CLI or run-gemini-cli version against the fixed releases. If a vulnerable version ran on attacker supplied content, assume the run environment and its tokens could have been reached and rotate anything sensitive from a clean machine.

Does this affect Claude Code and Codex as well as Gemini CLI?

Yes. Novee Security reported working paths against Claude Code, Gemini CLI, and Codex using the vendors' own repositories and default settings. Google issued a CVSS 10.0 advisory for the Gemini CLI case; the reporting we reviewed did not include equivalent severity scores or fixed versions for the Claude Code and Codex findings, so track each vendor's guidance directly.

Was this exploited in the wild?

There is no public evidence of exploitation so far. The work is a security demonstration presented at Black Hat USA 2026, not a report of an active campaign. The practical takeaway is the same either way: any automated pipeline that runs untrusted code, or lets an agent run commands based on untrusted text, can be pushed to do the attacker's work.