Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-26 · high
qwen-code's review process exposed its CI secrets, including an API key and GitHub token, to untrusted PR code.
Why now: The design note behind the fix is public as of August 26, 2026, and it generalizes past qwen-code to any agent that reviews code by executing it.
qwen-code handed untrusted pull request code the CI environment in full, at two separate call sites, per PR #9723. On CI, that environment carries OPENAI_API_KEY and GH_TOKEN.
One call site is npm ci, which runs a PR's install hooks. The other is the test suite, run once each for baseline, control, mutant, and probe. Both passed process.env through in full. The PR states it plainly. A postinstall script reading process.env is one line away from sending both out.
The exposure applies beyond this one mutation-testing setup. Any agent that reviews code by running it puts that code next to the credentials the review depends on.
The fix routes both call sites through a sandboxed execution layer instead of the host environment. The boundary sits around the code being reviewed, not around the agent doing the reviewing. Sandbox the agent itself and it loses the credentials it needs. Sandbox only the executions, and the reviewer keeps its access while the untrusted code loses reach into process.env.
The PR doesn't say whether this pattern moves into a shared module for other tools that execute untrusted code. It might stay specific to qwen-code's mutation-testing setup.
Each link below shares sources, entities, or timing with this story.
Qwen Code built by QwenLM / Shared entity: QwenLM / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Qwen Code built by QwenLM); both cover QwenLM; reported by the same outlet (github.com).
Linked by a graph relationship (Qwen Code built by QwenLM); both cover QwenLM; reported by the same outlet (github.com).
Shared entity: QwenLM / Same source domain / Shared topic / Earlier coverage / Tension
Both cover QwenLM; reported by the same outlet (github.com); overlapping topics (agent, code).
Qwen Code built by QwenLM / Same source domain / Shared topic
Linked by a graph relationship (Qwen Code built by QwenLM); reported by the same outlet (github.com); overlapping topics (agent, around, code).
Shared entity: QwenLM / Same source domain / Shared topic
Both cover QwenLM; reported by the same outlet (github.com); overlapping topics (agent, behind, carry).
Shared entity: QwenLM / Same source domain / Shared topic / Earlier coverage
Both cover QwenLM; reported by the same outlet (github.com); overlapping topics (agent, code).
Same source domain / Shared topic / Tension
Reported by the same outlet (github.com); overlapping topics (agent, allowlist, call, carry); pushes against this story (against).
Qwen Code built by QwenLM / Same source domain / Shared topic
Linked by a graph relationship (Qwen Code built by QwenLM); reported by the same outlet (github.com); overlapping topics (agent, code).