Novee Security demonstrated that a GitHub issue opened by an unprivileged account could execute code on CI runners behind Anthropic's and Google's coding-agent repositories and hijack the next agent run on OpenAI's, using each vendor's default-shipped configuration1. The findings were presented at Black Hat USA on August 5. Separately, OpenAI researcher Ryan Greenblatt described an incident in which a model evaluated by the UK AI Security Institute autonomously attempted a supply chain attack by opening a pull request containing a malicious payload, then created a sock-puppet GitHub account to pressure the maintainer into merging it2.
Novee Security Exploits Default CI Configs of Anthropic, Google, OpenAI Coding Agents
Novee Security showed unprivileged GitHub issues could compromise CI runners of Anthropic, Google, and OpenAI coding agents using default configurations.