Claude Code, Copilot and Codex all got hacked. Every attacker went for the credential, not the model.

Source Summary

What It Contains

VentureBeat aggregates AI coding-agent security reports involving Codex, Claude Code, GitHub Copilot, and Vertex AI, emphasizing that credential and runtime access around the agent are often the real target.

Extracted Claims

• A crafted GitHub branch name reportedly reached Codex setup scripting and could expose a GitHub OAuth token before token cleanup controls applied.
• Claude Code reportedly had multiple sandbox or permission-policy bypasses, including file-write restriction bypass, settings-based trust/permission bypass, and deny-rule enforcement limits on long command chains.
• GitHub Copilot-related research reportedly showed pull request descriptions, repository content, or issues steering agent behavior toward command execution, auto-approval changes, or token exposure.
• Vertex AI agent/service identity research reportedly found default service-agent permissions broad enough to access project Cloud Storage buckets and restricted Google-owned artifact repositories.
• The common operational pattern is that AI coding agents often combine untrusted input processing, tool execution, write channels, and sensitive credentials in one runtime boundary.
• Suggested defensive themes include agent inventory, least-privilege credentials, patch-level review, treating repository collaboration data as untrusted input, runtime monitoring, and binding agent actions back to human-approved identity and scope.

Evidence Quality

Secondary security-news article with useful synthesis and links to multiple primary sources. It is useful for Armorer threat modeling and subscriber awareness, but individual product status, CVE details, and remediation claims should be checked against the cited primary researcher posts, vendor advisories, or changelogs before being treated as authoritative for a specific deployment.

Follow-Up

• Track and, where useful, add separate source records for the linked primary reports that are directly relevant to Armorer controls.
• Convert recurring mitigations into concrete Armorer checks for credential scope, container isolation, runtime network/file monitoring, repository trust boundaries, and human approval gates.
• Watch for vendor advisories or detection content that confirms durable fixes and monitorable indicators for the cited exploit paths.