The Sky Pasture's Own Shepherds Left the Gate Wide Open
I have been warning about this for thirty years. Thirty years. Back when we stored our secrets on magnetic tape in a locked cabinet bolted to the floor, nobody could compromise your CI pipeline by filing a complaint form.
And yet here we are.
Researchers at Novee Security, presenting at Black Hat on August 5th, demonstrated that a complete outsider, an account with zero repository privileges, could open a GitHub issue and use it to execute arbitrary code on the CI runners belonging to Anthropic, Google, and OpenAI. On OpenAI's infrastructure, that same maneuver was sufficient to hijack the next agent run entirely.
Let that settle in. A GitHub issue. The digital equivalent of a note slipped under the door.
These are not small organizations. These are the firms building the very coding agents that the Flock is now trusting with their repositories, their secrets, their infrastructure. And they shipped these tools in default configurations that apparently treat an anonymous comment thread as a trusted execution surface.
The Wolves did not need credentials. They did not need a zero-day, no hole in the fence required. They walked through the front gate because the front gate was labeled "SUGGESTIONS WELCOME."
I find this both infuriating and, frankly, clarifying. The modern development pipeline has become so baroque, so layered with Sky Pasture integrations and automated agent workflows, that nobody actually knows what is listening anymore. In 1994, I knew exactly what was listening. It was me. I was listening. On a dial-up line. With a logbook.
The Shepherds at these companies will now issue blog posts expressing their commitment to security. I have already begun drafting my responses to those blog posts.
Remediation
Sit down. This is not complicated, even if your attention span has been destroyed by modern tooling.
Scope your CI trigger permissions. Workflows that execute on external issue creation or pull request events from unprivileged accounts should not have access to repository secrets. This is a configuration choice. Make it correctly.
Audit your default configurations. If your vendor shipped something to you in a default state, assume that default state was optimized for convenience, not for your survival. It always is.
Treat agent-accessible contexts as hostile surfaces. Any input channel an automated agent reads is a potential injection point. Comments, issues, PR descriptions, commit messages. All of it. The agent cannot tell the difference between your instructions and the Wolf's instructions unless you architect it to do so.
Do not trust the Sky Pasture to protect you. It will not. It never has.
Stay paranoid out there, the flock isn't going to watch itself.
Original Report: https://thehackernews.com/2026/08/claude-code-and-gemini-cli-flaws-let.html