Back Feeds.4Sysops

Patch Claude Code and Gemini CLI before GitHub issues reach CI secrets

Feeds.4Sysops •IT News • August 7, 2026

A malicious GitHub issue could reach CI workflow secrets and execute code through Anthropic’s Claude Code and Google’s Gemini CLI. Both vulnerabilities are patched, but OpenAI’s related Codex issue has no product update to install and requires workflow changes instead. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Vulnerabilities in AI Coding Tools Expose GitHub Secrets to Attackers AI coding tools from Anthropic, Google, and OpenAI were found vulnerable to malicious GitHub issues. Researchers at Novee Security identified flaws in Claude Code, Gemini CLI, and Codex that could allow remote code execution, credential theft, and repository modifications. The vulnerabilities stem from hidden instructions in GitHub issues, with Gemini CLI receiving a critical CVSS score of 10.0. While patches have been issued for Claude Code and Gemini CLI, OpenAI's Codex requires workflow changes without a product update. Novee Security urged companies to review their workflows and limit token permissions due to similar configurations in over 100 public repositories. The vulnerabilities pose significant risks to developers and organizations using these tools. 2 sources 69

Extracted Entities

Patch Claude Code and Gemini CLI before GitHub issues reach CI secrets

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (2)