Security researchers have uncovered multiple vulnerabilities affecting AI-powered coding assistants from Anthropic, Google, and OpenAI, demonstrating how seemingly harmless GitHub interactions could compromise continuous integration (CI) environments and automated coding workflows.
The findings, presented by Novee Security at Black Hat USA on August 5, revealed that a GitHub issue submitted by an account without repository privileges was enough to execute code on CI runners used by Anthropic’s and Google’s coding-agent repositories. In OpenAI’s case, researchers showed they could hijack the next automated Codex agent run.
The research resulted in two CVEs, both of which have now been patched.
Gemini CLI Vulnerability Receives Maximum Severity
The most critical issue affects Google’s Gemini CLI and has been tracked as CVE-2026-12537, receiving a CVSS v4 score of 10.0.
The vulnerability is an operating system command injection flaw in Gemini CLI’s container launcher. Researchers found that a specially crafted .gemini/.env file could execute arbitrary commands on the host machine before the sandbox environment was initialized.
Because the attack occurs before sandbox protections are applied, an attacker with limited privileges could potentially execute code on CI hosts running headless workflows.
Google addressed the issue in:
- Gemini CLI 0.39.1
- run-gemini-cli 0.1.22
Claude Code Bug Could Leak API Keys
Researchers also identified a flaw in Anthropic’s Claude Code, tracked as CVE-2026-54316.
The vulnerability abused Hugging Face’s public download counter as a covert data exfiltration channel, allowing attackers to leak API keys one character at a time.
According to Anthropic, successful exploitation required an attacker to introduce untrusted content into a Claude Code execution context.
The issue affects every Claude Code release from 0.2.54 through 2.1.163 and has been fixed in version 2.1.163.
Anthropic assigned the flaw a Moderate severity rating with a CVSS v4 score of 6.0, while the U.S. National Vulnerability Database (NVD) rated it 9.1 under CVSS v3.1. Since the scoring systems differ, the ratings should not be directly compared.
OpenAI Codex Workflow Weakness
Unlike the Google and Anthropic vulnerabilities, the issue affecting OpenAI Codex did not receive a CVE identifier or require a product patch.
Novee Security found that OpenAI’s GitHub workflow executed two Codex runs within the same CI job using a shared repository checkout.
Researchers demonstrated that the first run could modify an AGENTS.md instruction file, which the second Codex execution would later load as trusted input. Triggering a JSON validation failure between the two runs caused the second execution to process the attacker-controlled instructions.
OpenAI maintained that the sandbox functioned as designed. Instead of modifying Codex itself, the company updated its GitHub workflow by separating the two execution stages into different jobs and running Codex inside a read-only sandbox with reduced privileges.
The company’s updated security guidance now advises developers to treat repository instruction files as untrusted input and recommends running Codex as the final step in CI workflows to prevent subsequent privileged processes from interacting with files left behind by the agent.
Root Cause: The Automation Harness
According to Novee Security, the vulnerabilities were not caused by the AI models themselves but by the surrounding automation infrastructure, commonly referred to as the harness.
The harness acts as the bridge between an AI model and the operating system, determining which commands are executed and with what permissions.
Researchers observed a recurring design flaw across multiple products: one component marked data as safe, while another later executed that same data with elevated authority.
Additional Security Findings
Novee also identified other weaknesses during its research:
- Claude Code removed single-quoted strings before applying command validation, allowing specially crafted
git push --receive-packarguments to bypass security checks and reach CI runners. This issue currently has no CVE identifier or publicly announced fixed version. - Gemini CLI only enforced its tool allowlist during registration rather than at execution time. When running with the
--yolooption, every command requested by the AI model was automatically approved. Google corrected this behavior alongside the command injection vulnerability.
Google stated that the updates apply to all Gemini CLI GitHub Actions.
No Evidence of Active Exploitation
At the time of publication:
- Neither vulnerability appears in CISA’s Known Exploited Vulnerabilities (KEV) catalog.
- CISA reports no known active exploitation for either CVE.
- Researchers identified a public GitHub repository demonstrating the Claude Code vulnerability, but there is no evidence that the techniques have been used in real-world attacks.
Security Recommendations
Organizations using AI-powered coding assistants in CI/CD pipelines should:
- Update Gemini CLI to 0.39.1 or later.
- Update run-gemini-cli to 0.1.22 or later.
- Upgrade Claude Code to 2.1.163 or newer.
- Review GitHub Actions and CI workflows that can be triggered by external contributors.
- Treat repository instruction files, prompts, and other AI inputs as untrusted content.
- Run AI coding agents as the final stage of CI pipelines whenever possible.
- Enforce least-privilege permissions and isolate execution environments.
Related Supply Chain Threats
The disclosure comes shortly after Pillar Security reported that operators behind the ChainDrop npm worm embedded malicious Claude Code SessionStart hooks and Visual Studio Code folderOpen tasks into compromised repositories.
Instead of waiting for developers to install malicious packages, the attack executed automatically when victims simply opened the affected project in their development environment, highlighting the growing security risks surrounding AI-assisted software development workflows.
