A GitHub comment can steal your secrets. I found 22 repositories where it could.
After the CI hygiene piece, I kept looking at GitHub Actions workflows in AI agent projects, but for something more specific this time: repositories that run an AI CLI, Claude Code, GitHub Copilot CLI, Codex, directly inside a workflow job. The pattern that mattered was always the same. A workflow triggers on something anyone on the internet can create: an issue, a comment on an issue, a pull request title. It then runs the AI CLI with a flag that skips every confirmation prompt, something like
🎯 Vulnerability: Remote Code Execution (RCE)
💡 Defense Fix: Avoid executing shell commands via system(). Use parameterized APIs and strict input sanitization.