A GitHub issue is now a credential-stealing primitive

The attacker in this story has a GitHub account, no write access to anything, and one move: open an issue. That is the whole budget. It works because somewhere in the repository's automation an agent will read that issue and treat it as instruction.

A download counter as the exfiltration channel

The Claude Code advisory describes something better than a stolen key. huggingface.co was pre-approved as a bare hostname for WebFetch, so fetching an attacker-controlled file under it raised no prompt. No allowlist was broken; the domain really was on the list.

Then the channel: Hugging Face counts downloads server-side, and the owner of a repository can watch that counter move. So the payload sends nothing anywhere. It reads a secret and encodes it by choosing which files to request.

Trust that shipped inside the repository

The Gemini CLI finding is a straight 10.0, and the reason is structural rather than clever. In headless mode the tool trusted workspace folders automatically, and under --yolo it ignored the user's own tool allowlist. The configuration meant to constrain the agent lived inside the thing the agent was pointed at, so a pull request could bring its own permissions.

Poisoning the file the next pass will obey

The third chain needs no CVE because it needs no bug. It is a workflow that runs the agent twice and lets the first run write a file the second run reads as authority.

1. attacker content lands in a GitHub issue
2. pass one writes it into AGENTS.md
3. pass one returns invalid JSON on purpose, so the job retries
4. pass two loads AGENTS.md as authoritative instructions
5. attacker holds standing control of pass two

Step three is the craft. Failing deliberately is what causes the second pass to exist, so the retry logic is not being broken, it is the delivery mechanism.

One from outside the AI world

The same window produced an origin validation error in Windows NAT. Before anyone panics, read the vector: AV:A means adjacent network rather than internet, and AC:H means high complexity. A strong finding for somebody already on your segment, which is a narrower threat model than the score alone suggests.

The pattern worth keeping

CSA names the root cause well: validation that inspects a command as a plain string diverges from the shell, interpreter or parser that executes it. Every finding above lives in that gap, and it is the same claim we make about MCP servers from the other side. If an agent reads tool descriptions and acts on them, the description field is not documentation, it is input.

• Patch the three tools to the versions in the ledger below.
• Stop handing long-lived secrets to jobs that read untrusted repository content. Scope tokens per job, keep them short lived.
• Never let one agent pass write the instruction file another pass reads. Instruction files belong to the repository owner, not to the run.
• Audit allowlists for what they permit, not who they name. A trusted host serving attacker-controlled paths with observable side effects is an exfiltration channel with a good reputation.