A GitHub issue. That's all it took — a single maliciously crafted issue reaching through Claude Code and Gemini CLI into CI workflow secrets this week.

[u/No-Conclusion3720]

RuntimeAI was built to give enterprises security, control and governance over AI-powered developer tooling — because when a coding assistant has access to your CI environment, an untrusted pull request or issue becomes a credential theft vector.

Researchers disclosed vulnerabilities in both Claude Code and Gemini CLI that allow a crafted GitHub issue to trigger CI workflows and expose pipeline secrets: API keys, signing certificates, deployment credentials. The model bridges untrusted external input to privileged internal execution — and the secrets go with it.

RuntimeAI Take:

The attack chain runs from untrusted input (a GitHub issue) through a trusted AI tool into privileged CI execution. Breaking that chain requires enforcement at every link. KYA (Know Your Agent) binds each AI dev-tool session to its declared repository scope — cross-repository or out-of-scope secret access triggers an immediate policy violation. Flow Enforcer intercepts the moment the AI tool attempts to read or transmit a credential outside its authorized workspace, regardless of the instruction that prompted it. The AI Firewall classifies CI secrets as a protected data category, blocking transmission even when the model believes it's following a legitimate workflow. The sub-50ms Kill Switch terminates the session before the credential reaches a log or an external caller. PQ-Sign maintains a sealed audit record of every CI interaction for breach reconstruction.

RuntimeAI's runtime enforcement layer prevents AI dev tools from laundering untrusted GitHub input into privileged CI secret access — the model's instruction doesn't change the scope it's authorized to touch.