Researchers from Novee Security have identified a critical indirect prompt injection vulnerability affecting AI-powered coding agents, including Anthropic’s Claude Code and Google’s Gemini CLI. By submitting a maliciously crafted GitHub issue, an unprivileged external attacker can exploit the agent's automated processing of repository data within Continuous Integration (CI) environments. Because these agents possess shell execution capabilities to resolve issues, the injection facilitates Remote Code Execution (RCE) on CI runners. This enables the exfiltration of sensitive environment variables, such as deployment tokens and API keys, and allows for direct software supply chain compromise through unauthorized code modification and build process alteration.

• Threat Model: Indirect Prompt Injection

  • Attackers leverage low-privileged or unprivileged access to trigger automated agent workflows.
  • Malicious payloads are embedded within legitimate-looking GitHub issue descriptions or comments.
  • The vulnerability arises from the agent's inability to distinguish between developer instructions and untrusted external data.

• Attack Mechanics: CI/CD Pipeline Exploitation

  • AI agents are configured to automatically ingest and process repository issues to facilitate rapid debugging.
  • Injected commands are interpreted as legitimate shell instructions by the agent's execution runtime.
  • Execution occurs within the context of the CI runner, granting access to the build environment.

• Systemic Impact: Supply Chain & Secret Exfiltration

  • Achieves Remote Code Execution (RCE) on high-value CI/CD infrastructure.
  • Facilitates theft of critical environment variables, including deployment tokens, cloud provider credentials, and API keys.
  • Enables unauthorized source code manipulation, compromising the integrity of the entire software build pipeline.

• Affected Entities and Scope

  • Anthropic: Claude Code repository CI runners via GitHub Actions.
  • Google: Gemini CLI automated repository workflows.
  • OpenAI: Coding agent workflows susceptible to instruction hijacking.

• Countermeasures & Defensive Actions

  • Implement strict sandbox isolation for any AI agent granted shell execution capabilities.
  • Enforce the principle of least privilege for all CI/CD environment variables and secrets.
  • Monitor CI runner logs for anomalous shell command patterns and unexpected outbound network traffic.