AI-assisted discovery of critical GitHub RCE vulnerability in git infrastructure
Security firm Wiz used AI models including Claude Code to discover CVE-2026-3854, a critical remote code execution vulnerability in GitHub's git infrastructure, within 48 hours. GitHub patched the flaw in under six hours from the report, with no evidence of exploitation.
What happened
Wiz researchers used AI models including Claude Code and IDA MCP to discover CVE-2026-3854, a critical remote code execution vulnerability in GitHub's internal git infrastructure. The vulnerability could allow any authenticated user to run arbitrary code on backend servers via a git push command, enabling full read-write access to private repositories.
The flaw existed in how GitHub's server-side git push operations handle cross-component trust boundaries in the closed-source X-Stat protocol. Wiz reverse-engineered GitHub's compiled binaries without access to source code, using AI-augmented tooling to complete the analysis in approximately 48 hours.
Reported impact
The vulnerability was scored 8.8 in severity and could have exposed millions of public and private code repositories to unauthorized access. GitHub's forensic investigation concluded there was no evidence of exploitation prior to patching.
Index analysis
Wiz researcher Sagi Tzadik noted this was one of the first critical vulnerabilities discovered in closed-source binaries using AI. The vulnerability was described as remarkably easy to exploit despite the complexity of GitHub's underlying system.
GitHub's CISO Alexis Wales confirmed the company reproduced the vulnerability internally within 40 minutes of the report and deployed a fix just over an hour after identifying the root cause.
Governance controls
GitHub deployed a fix to both github.com and GitHub Enterprise Server within six hours of receiving the Wiz report. The rapid response and forensic investigation demonstrating no prior exploitation earned Wiz one of the top rewards available in GitHub's Bug Bounty program.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.