Claude Code, Gemini CLI, and OpenAI Agents Vulnerable to Indirect Prompt Injection
Researchers from Novee Security have identified a critical indirect prompt injection vulnerability affecting AI-powered coding agents, including Anthropic’s Claude Code and Google’s Gemini CLI. By submitting a maliciously crafted GitHub issue, an unprivileged external attacker can exploit the agent's automated processing of repository data within Continuous Integration (CI) environments. Because these agents possess shell execution capabilities to resolve issues, the injection facilitates Remote Code Execution (RCE) on CI runners. This enables the exfiltration of sensitive environment variables, such as deployment tokens and API keys, and allows for direct software supply chain compromise through unauthorized code modification and build process alteration.