A newly disclosed critical flaw in AI coding-agent workflows from Anthropic, Google, and OpenAI could allow an unauthenticated attacker to exploit a malicious GitHub issue for remote code execution (RCE), credential theft, persistent agent hijacking, or software supply chain compromise This article explores untrusted inputs github. . The common issue was not the underlying language model but the agent harness: permission logic, tool routing, sandbox controls, shared workspace, and execution environment surrounding the model.
Critical Flaws in Claude Code, Gemini CLI, and OpenAI Codex Each transition between these components introduces a security barrier and has been observed where an attacker-controlled input breaches this boundary with elevated privileges not intended.
The demonstrated attack path starts from untrusted inputs within GitHub issues or workflows, followed by payload injection that influences agents possessing access to tools or writable environments. The Google Gemini CLI case involved two flawed assumptions: an apparently restricted shell tool that was not enforced at runtime, and environment sanitization that removed secrets only from a child process while leaving them intact in the parent process. Elad Meged highlighted that a compromised child process could access the parent process's environment through Linux process interfaces, thereby recovering intended isolated credentials.
Organizations adopting similar multi-pass patterns must make equivalent changes: isolate jobs, avoid shared writable state, minimize tokens, and treat every agent-readable file as untrusted input.
