A shared trust risk has been identified in three AI coding agents including Claude Code, Gemini CLI and Codex, in which malicious GitHub issues can affect follow-on agent runs. On Aug. 10 local time, Taiwan media outlet IT Home reported that security firm Nobi Security analysed the automated workflows of Anthropic's Claude Code, Google's Gemini CLI and OpenAI's Codex and said trust boundaries can break across tool permissions, sandbox isolation and shared workspaces.

The issue was not limited to simple prompt injection. When external input is linked to tools such as files, command lines and networks, each security layer can judge what is trusted work differently. In that case, restrictions that were valid at one step may no longer apply when carried over to the next step. Researchers believed this structure could enable remote code execution, leaks of confidential information and persistent control over follow-on agents.

In Claude Code, a method was identified in which security checks are bypassed through permitted Git operations and arbitrary code is then executed in the runtime environment. Even after Anthropic addressed this, researchers additionally found paths to read confidential information in the environment or exfiltrate API keys externally through public services.

In Gemini CLI, problems emerged with command restrictions and process isolation. It appeared that only some commands were allowed, but restrictions were not fully applied at the actual execution stage. It also removed GitHub tokens and Gemini API keys from child processes, but the information remained in the parent process. Attackers could have a chance to read it in the same execution environment. Google assessed the severity at CVSS 10.0 and modified the trust mechanism for non-interactive automated execution environments.

In Codex, the issue was that two agent runs share the same workspace. If the first Codex is affected by malicious content, it can write the project instruction file AGENTS.md that Codex reads automatically. When the second Codex starts, it loads this file again as instructions, allowing malicious influence from the first step to carry into the next step. OpenAI separated the two Codex runs into different work environments and applied a read-only sandbox.

Researchers also confirmed similar AI agent automation configurations in more than 100 public repositories.

The cases show that trust design across the entire automated workflow can matter more than safeguards in the AI model itself. It confirmed that how files, permissions and execution environments connect step by step determines the actual security level.