Wiz uncovers critical flaws in AI‑powered GitHub Actions from OpenAI, Anthropic, and Google
Wiz’s analysis of popular AI GitHub Actions—OpenAI’s Codex, Anthropic’s Claude, and Google’s Gemini—reveals misconfigurations that let any actor trigger AI runs, bypass default permission checks, and exfiltrate dynamically generated credentials. The vulnerabilities affect thousands of public workflows across repositories with over 200,000 combined stars.