A GitHub issue can now potentially exfiltrate your CI secrets, and the tool that let it happen is the same one your team is using to "move faster." That's the story, and it deserves more than zero comments.
Context
This isn't new math, it's an old bug class wearing a new jacket. Time-of-check-to-time-of-use flaws have been around since multi-user Unix systems first had race conditions in file permissions. What's new is the attack surface: coding agents that read GitHub issues, .env files, or an AGENTS.md config as "context," decide that context is safe in one pass, then act on it with full privileges in a later pass. Swap "file descriptor" for "LLM prompt" and you've basically got the same bug your professor warned you about, except now it's got a CVE and a marketing problem.
Three vendors, three implementations, the same architectural flaw. That's the part worth sitting with. When Claude Code, Gemini CLI, and OpenAI Codex all have a harness-level validation gap, that's not a coincidence, that's convergent evolution. Everyone building these agent harnesses is solving the same problem (let the model act autonomously on external input) with the same shortcut (validate once, trust forever).
