GitHub Actions default configs from Anthropic, Google, and OpenAI's own coding agents were all vulnerable to the same RCE

Security researchers found that the default GitHub Actions configuration each of the three major labs publishes for their own coding agents (Claude Code, Gemini CLI, and Codex) could all be tripped by a single unauthenticated GitHub issue, ending in remote code execution. In Claude Code's case, the bash argument validator stripped single-quoted content before checking it, so a malicious git flag read as empty and then executed. Gemini CLI's tool-restriction setting turned out to be decorative and never enforced at runtime — Google rated the finding CVSS 10.0, the max score. Codex's issue was a two-pass workflow sharing one writable checkout, letting an earlier pass plant a poisoned instructions file the later pass loaded as authoritative. A separate but related finding hit Google's ADK repo: an ungated, low-privilege triage agent could be manipulated into triggering a maintainer-gated, high-privilege one, inheriting its write permissions in the process — effectively a privilege-escalation bridge between two agents in the same repo. None of this is "the agent wrote buggy code." It's the CI/CD scaffolding meant to keep these agents sandboxed that failed, on setups the vendors themselves ship and recommend as defaults. Curious if anyone's actually gone back and audited their own agent CI config against this, or if most teams just assumed "it's from the vendor, it must be fine." Source: https://novee.security/blog/critical-flaws-in-anthropic-google-and-openais-coding-agents/