Claude Code漏洞評測：一則GitHub Issue駭進三大AI編程代理 | Claude Code CVE Review: One GitHub Issue Hacks 3 AI Agents

8月 13, 2026

By Kit 小克 | AI Tool Observer | 2026-08-14

🇹🇼 Claude Code漏洞評測：一則GitHub Issue駭進三大AI編程代理

Claude Code漏洞評測正式登場——資安公司Novee Security在8月5日的Black Hat USA 2026會議上，揭露一個影響Anthropic、Google、OpenAI三家AI編程代理的重大漏洞：攻擊者只要在GitHub上開一則沒有任何倉庫權限的Issue，就能一路打進CI/CD執行環境，偷走API金鑰、執行任意程式碼，甚至竄改倉庫內容。

發生了什麼事

研究者Elad Meged發現，這三套主流AI編程代理在處理GitHub Issue內容時，都把使用者輸入當成可信指令執行，形成典型的提示注入（prompt injection）攻擊面：

Claude Code：攻擊者在Issue裡藏入指令，誘使代理執行看似合法、實則濫用Git receive-pack選項的git push指令，繞過Anthropic的驗證檢查，在GitHub Actions執行環境上跑程式碼，連帶洩漏GitHub與Anthropic的API Token。
Gemini CLI：漏洞編號CVE-2026-12537，CVSS評分滿分10.0，透過偽造的.gemini/.env檔案觸發容器啟動器的作業系統命令注入，攻擊者甚至不需要沙盒啟動就能在主機上執行程式碼。
OpenAI Codex：攻擊足以劫持下一輪的代理執行，讓惡意指令在後續任務中持續生效。

為什麼這件事很重要

這不是實驗室裡的理論漏洞，而是直接打在三大廠自己的官方倉庫上——換句話說，連Anthropic、Google、OpenAI自己用來開發AI編程代理的CI管線都曾暴露在風險中。對於已經把Claude Code、Gemini CLI接進CI/CD自動化流程的團隊來說，這代表任何一個公開倉庫的Issue區都可能是攻擊入口，尤其是那些會自動觸發代理讀取Issue內容並執行動作的工作流程。

該怎麼辦

好消息是三個漏洞都已修補，建議立刻檢查並更新：

Claude Code 升級到 2.1.163 以上版本
Gemini CLI 升級到 0.39.1，run-gemini-cli 升級到 0.1.22
若你的CI/CD有自動讓AI代理處理GitHub Issue或PR的流程，重新檢視權限範圍，避免代理在未經人工確認下執行寫入或推送操作

這次事件再次證明，AI編程代理的資安問題不是「會不會發生」，而是「什麼時候被找到」。如果你的專案已經導入這類自動化，現在就該去查版本號。

好不好用，試了才知道。

🇺🇸 Claude Code CVE Review: One GitHub Issue Hacks 3 AI Agents

Claude Code CVE review time — security firm Novee Security disclosed at Black Hat USA 2026 on August 5 that a single GitHub issue, opened by an account with zero repository privileges, was enough to reach CI/CD secrets and execute code across three major AI coding agents: Anthropic's Claude Code, Google's Gemini CLI, and OpenAI's Codex.

What Happened

Researcher Elad Meged found that all three agents treated content inside GitHub issues as trusted instructions — a classic prompt injection attack surface:

Claude Code: An attacker hides instructions in an issue that trick the agent into running a crafted git push command abusing Git receive-pack option. It passed Anthropic validation checks and executed code on the GitHub Actions runner, leaking both GitHub and Anthropic API tokens.
Gemini CLI: Tracked as CVE-2026-12537, with a perfect CVSS score of 10.0. A crafted .gemini/.env file triggers OS command injection in the container launcher — code execution on the host before the sandbox even starts.
OpenAI Codex: The flaw was enough to hijack the agent next run, letting malicious instructions persist across separate tasks.

Why It Matters

This is not a lab-only theoretical bug — it hit the vendors own production repositories. Anthropic, Google, and OpenAI official CI pipelines for building their own coding agents were exposed. If your team already wires Claude Code or Gemini CLI into CI/CD automation, any public repo issue tracker is a potential entry point — especially workflows that auto-trigger an agent to read and act on issue content.

What To Do

The good news: all three flaws are patched. Check versions now:

Update Claude Code to 2.1.163 or later
Update Gemini CLI to 0.39.1, and run-gemini-cli to 0.1.22
If your CI/CD lets an AI agent auto-process GitHub issues or PRs, re-audit its permission scope — do not let it push or write without human review

The takeaway: security issues in AI coding agents are not a matter of if, but when they get found. If you have already automated this workflow, go check your version numbers today.

好不好用，試了才知道。

Sources / 資料來源

延伸閱讀 / Related Articles

AI 工具觀察站 — 每日精選 AI Agent 與工具趨勢
AI Tool Observer — Daily curated AI Agent & tool trends

搜尋此網誌

AI小貼士