Day-2 debrief | One GitHub issue hijacked three AI coding agents. What should they be trusted to touch?

At Black Hat USA 2026, researchers showed that a public GitHub issue, submitted by someone with no repository privileges, could influence Claude Code, Gemini CLI and Codex running inside privileged CI workflows. The disclosed attack paths led to host command execution before sandboxing, API key exfiltration, and hijacking of a later agent run.

This is the third news signal analysis from Episode 1 of the Day-2 Debrief, Gruve’s monthly series analyzing the top industry news CIOs and CISOs need to know. Matt Locknane and Rajeev Khanolkar explain why the CI runner has become the most privileged and least inspected machine in the company, and what has to change before agents reach code, secrets, or CI/CD.

In this clip:

• Why this is an architecture problem that assumed the pipeline provided trusted input
• The gap between what was known and what was enforced
• Allow lists checked at startup but never enforced at runtime
• Why a severity score on a dashboard is not a control
• Treating the agent as an unauthenticated remote input path, and repository instruction files as untrusted input
• Protecting the code from the pipeline: agents last, read-only by default, no auto-approve
• Why source code and CI/CD pipelines need their own segmentation standards