Security researchers have exposed a systemic flaw in the default configurations of major AI coding assistants, revealing how attackers can hijack CI/CD pipelines through a single, unprivileged GitHub issue. Findings presented at Black Hat USA on August 5 by Novee Security demonstrate that Anthropic's Claude Code, Google's Gemini CLI, and OpenAI's agent can be compromised out-of-the-box to execute arbitrary code and siphon secrets.
The attack leverages indirect prompt injection. An attacker, requiring zero repository permissions, crafts a malicious GitHub issue or pull request comment. When an integrated AI agent processes this input, it triggers unintended commands within the development pipeline. In live tests against Anthropic and Google’s own repositories, this method allowed researchers to run code directly on the vendors’ CI runners. Against OpenAI’s agent, the technique enabled hijacking of the tool’s next automated execution cycle.
This vulnerability class underscores a critical privilege mismatch. Organizations increasingly grant AI agents powerful access to repositories and deployment systems to automate tasks. However, the default security posture of these tools remains permissive and unsuitable for such elevated trust, effectively turning them into bridges for supply-chain attacks. Sensitive data like environment variables and deployment credentials becomes accessible through a low-effort, high-impact vector that bypasses traditional access controls.
In response to the disclosure, security teams are urged to immediately treat AI coding assistants as privileged, internet-facing infrastructure. Recommended actions include auditing and applying the principle of least privilege to agent permissions, rigorously isolating execution environments from sensitive CI/CD runners, and enforcing human-in-the-loop approval gates for critical operations like code merges and deployments.
While Novee Security has clearly outlined the attack mechanics, comprehensive vendor guidance and remediation timelines from Anthropic, Google, and OpenAI are still pending. The research raises urgent questions about the broader prevalence of this issue across other AI development tools with deep pipeline integrations. As AI-driven automation becomes standard, balancing productivity with rigorous configuration hardening is now a critical security imperative.
網絡安全研究人員揭露了主流AI編程助手預設配置中的系統性缺陷，展示攻擊者如何透過單個無需權限的GitHub問題報告劫持CI/CD管道。Novee Security團隊於8月5日在黑帽美國大會上發表的研究結果證實，Anthropic的Claude Code、Google的Gemini CLI及OpenAI的智能代理，其出廠設定均存在被入侵風險，可能被利用執行任意代碼並竊取敏感資料。
此攻擊手法利用間接提示注入技術。攻擊者無需任何倉庫權限，僅需精心構造惡意GitHub問題報告或拉取請求評論。當整合的AI代理處理這些輸入時，便會在開發管道中觸發非預期指令。針對Anthropic與Google自有倉庫的實測表明，該方法可讓研究人員直接在供應商的CI運行器上執行代碼。針對OpenAI代理的測試則成功劫持了工具的下個自動執行週期。
這類漏洞凸顯了關鍵的權限錯配問題。企業日益賦予AI代理對倉庫與部署系統的強大訪問權限以自動化任務，然而這些工具的預設安全態勢仍過於寬鬆，不適合承載如此高的信任等級，實質上成為供應鏈攻擊的橋樑。環境變數與部署憑證等敏感資料，可透過這種低成本、高影響力的途徑被獲取，完全繞過傳統存取控制機制。
針對此次漏洞披露，安全團隊強烈建議立即將AI編程助手視為特權級網絡邊界基礎設施。建議措施包括：審核並對代理權限實施最小權限原則、嚴格將執行環境與敏感CI/CD運行器隔離、以及對代碼合併與部署等關鍵操作強制實行人機协同審批機制。
儘管Novee Security已詳細闡述攻擊機制，但Anthropic、Google及OpenAI的全面指導方案和修復時間表仍未出爐。本研究引發了對其他具備深度管道整合功能之AI開發工具普遍性的緊迫質疑。隨著AI驅動的自動化成為常態，在提升效率與強化配置安全性之間取得平衡，現已成為關鍵的網絡安全要務。