CodeRabbit RCE: 1M Repositories Compromised

Security researchers discovered a critical vulnerability in CodeRabbit, a popular AI code review tool, leading to remote code execution (RCE). By exploiting a flaw in Rubocop's configuration, attackers executed malicious code, stealing sensitive information including Anthropic and OpenAI API keys, GitHub App private keys, and gaining read/write access to 1 million code repositories (including private ones). This highlights the critical need for integrating security into the development lifecycle of AI-powered products.