Major AI Labs' Coding Agents Vulnerable to Remote Code Execution

Security researchers have uncovered critical vulnerabilities in the default GitHub Actions configurations used by leading AI developers Anthropic, Google, and OpenAI for their respective coding agents. The flaws, present in agents like Claude Code, Gemini CLI, and Codex, could allow unauthenticated attackers to achieve remote code execution (RCE).

The vulnerabilities stem from weaknesses in the CI/CD scaffolding designed to sandbox these AI agents, rather than flaws in the agents' generated code. For instance, Claude Code's argument validator incorrectly processed quoted content, while Gemini CLI's tool-restriction settings were found to be unenforced. OpenAI's Codex suffered from a shared writable checkout that allowed an earlier stage to inject malicious instructions for a later stage to execute.

In addition to these agent-specific issues, a separate vulnerability was identified in Google's ADK repository, where a low-privilege triage agent could be manipulated to trigger a high-privilege maintainer agent, effectively escalating permissions. Google has assigned a CVSS score of 10.0, the maximum severity, to the Gemini CLI finding, highlighting the significant risk posed by these security lapses.