[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fCwIHGEcXTrslu7iSubm2D7LZ2-fbTixTUZLoVx_Wivg":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":58},"8e2031d1-7c31-4bb7-a8f3-5457fb8eaf18","ai-cli-tools-exposed-cicd-secrets-via-code-execution-flaws","645cac75-53af-4418-b80d-067260de935a","AI CLI Tools Exposed CI\u002FCD Secrets via Code Execution Flaws","Vulnerabilities in widely adopted AI developer tools — Claude Code, Gemini CLI, and OpenAI Codex — allowed attackers to escalate from a simple GitHub issue submission to full code execution on CI runners, potentially exfiltrating workflow secrets and environment variables. The root cause lies in insufficient input sanitization and trust boundary enforcement within tools that are deeply integrated into software supply chains. Because these CLI agents operate with elevated privileges in automated pipelines, a single exploitable flaw can compromise entire build and deployment environments. This matters because AI coding assistants are rapidly becoming critical infrastructure in development workflows, yet their security posture often lags behind their adoption rate.","**Immediate actions:**\n- Upgrade Claude Code, Gemini CLI, and OpenAI Codex to their latest patched versions immediately, as all three have confirmed CVEs.\n- Audit all CI\u002FCD pipelines that invoke AI CLI tools and revoke or rotate any secrets exposed since these tools were first integrated.\n- Restrict CI runner permissions using the principle of least privilege so workflow secrets are scoped only to the jobs that require them.\n\n**Long-term improvements:**\n- Treat AI CLI tools as third-party supply chain dependencies and include them in formal Software Composition Analysis (SCA) and vulnerability tracking programs.\n- Enforce branch protection rules and require human review before any externally-triggered GitHub issue or PR can influence CI workflow execution.\n- Implement sandboxing or ephemeral isolated environments for CI runners that interact with AI agents to limit blast radius if exploitation occurs.\n\n**Detection measures:**\n- Enable detailed audit logging on CI\u002FCD platforms (GitHub Actions, GitLab CI, etc.) to detect anomalous secret access or unexpected outbound network calls from runners.\n- Deploy runtime monitoring on CI runners to alert on unusual process spawning or privilege escalation events initiated by AI tool processes.\n- Subscribe to CVE feeds and security advisories for all AI developer tools in your environment to reduce mean-time-to-patch for future disclosures.",[12,13,14,15,16,17,18,19,20,21,22,23],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 16: Application Software Security","NIST SP 800-218 (SSDF) PW.4: Reuse Existing, Well-Secured Software","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 SA-15: Development Process, Standards, and Tools","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 AU-12: Audit Record Generation","NIST CSF DE.CM-8: Vulnerability Scans","SLSA Supply Chain Levels for Software Artifacts — Level 2+ (hosted source & build)","OWASP Top 10 CI\u002FCD Security Risks: CICD-SEC-6 (Insufficient Credential Hygiene)","OWASP Top 10 CI\u002FCD Security Risks: CICD-SEC-9 (Improper Artifact Integrity Validation)",{},"published","2026-08-07T10:21:43.519067+00:00","2026-08-07T10:21:43.423+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fclaude-code-and-gemini-cli-flaws-let.html","claude-code-and-gemini-cli-flaws-let-a-github-issue-reach-ci-workflow-secrets-8eab46","Claude Code and Gemini CLI Flaws Let a GitHub Issue Reach CI Workflow Secrets",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":40,"name":41,"slug":42,"description":43,"color":44},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",{"id":46,"name":47,"slug":48,"description":49,"color":50},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[52],{"id":53,"date":54,"edition":55,"title":56,"audio_url":57},"3d92fe10-8cad-4959-93b0-69998be7a7c9","2026-08-07","afternoon","ThreatNoir Afternoon Brief — August 7","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-08-07\u002Fthreatnoir-afternoon-brief-2026-08-07.mp3",[59,63,66],{"slug":60,"name":61,"problem":62},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":42,"name":64,"problem":65},"Automated patch management","Known holes get closed in days, not months.",{"slug":67,"name":68,"problem":69},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped."]