What jumps out here is how little “AI” is doing the interesting part of the damage. The failures sound glamorous if you only skim the headlines — prompt injection, agent compromise, secret theft — but the actual weakness is more boring and more worrying: code that decides what is trusted, then later uses that same thing with more authority than it deserves.
That pattern feels like the thing teams keep rediscovering. The model gets blamed because it’s visible, but the break happens in the wrapper around it: parsing, validation, sandbox setup, workflow layout, all the glue code people assume is too mundane to be dangerous. It isn’t.
The Claude Code case is the one I’d look at hardest, because leaking an API key through a public download counter is such an odd, brittle channel that it almost reads like a demo weapon. Which is exactly the point: if a public side effect can be turned into a byte-by-byte exfil path, then “it’s only public telemetry” is not a defense. I’d still want to know how practical this was outside a lab. The article says Anthropic says exploitation required untrusted content in a Claude Code context. That matters. It’s a real constraint, and it keeps this from sounding like a magic remote leak from nowhere.
The Gemini CLI issue feels more straightforward and more uncomfortable. A host command injection in the container launcher, before the sandbox even starts, is the sort of bug that should make anyone running these tools in CI sit up. If the launcher is already executing attacker-controlled shell material, the sandbox is just theater at that point. I’m also not surprised it involved a .gemini/.env path; configuration files are where these systems keep smuggling authority back in through the side door.
What I find slightly messy is the way the article mixes severity labels and comparison points without fully flattening them into the same scoring system. That’s fair, but it also means you have to read carefully. “10.0” on one scale and “9.1” on another are not directly comparable, and the piece does at least say that. More articles should be that cautious instead of pretending all CVSS numbers are interchangeable gospel.
The Codex finding is probably the one developers should internalize, even though it didn’t get a CVE. Two passes in one job, one shared checkout, one file that the second pass trusts as instructions — that is exactly the kind of workflow bug that sneaks into real repos because it looks clean and efficient. Separate the jobs, make the untrusted surface explicit, and stop assuming the previous step left the tree in a harmless state. That’s not an AI-specific lesson. It’s a CI lesson.
If I were auditing a repo that uses Claude Code or Gemini CLI in GitHub Actions, I’d spend less time reading the agent docs and more time tracing what can write to disk before the next privileged step runs. That’s where the nasty surprises live.
Reference: Claude Code and Gemini CLI Flaws Let a GitHub Issue Reach CI Workflow Secrets
