AIThe Hacker Newsabout 3 hours ago
CI Flaws Expose Agent Secrets
1 min read
GitHub issues with no privileges executed code on Anthropic's and Google's CI runners, and hijacked OpenAI's next agent run. Novee Security found two CVEs, both patched. Gemini CLI's CVE-2026-12537 (CVSS 10.0) allows host command injection; fixed in 0.39.1. Claude Code's CVE-2026-54316 leaks API keys via Hugging Face counter; fixed in 2.1.163.
Level
Hype check
Tap to vote and see what everyone thinks.
Summary by ByteBrief
