Overview
At Black Hat USA on 5 August 2026, Novee Security disclosed that default deployments of three major AI coding agents — Anthropic’s Claude Code, Google’s Gemini CLI, and OpenAI’s Codex — could be compromised by nothing more than a GitHub issue opened by an account with zero repository privileges. Two CVEs were assigned and have since been patched; a third finding in OpenAI Codex produced no CVE, with OpenAI maintaining its sandbox behaved as documented.
Technical Analysis
CVE-2026-12537 — Gemini CLI OS Command Injection (CVSS 10.0)
A crafted .gemini/.env file triggers OS command injection in Gemini CLI’s container launcher. Crucially, this fires before the sandbox initialises, granting an unprivileged attacker direct code execution on the CI host. A second flaw meant the tool allowlist was only parsed at registration time; nothing re-enforced it at runtime, so under the --yolo flag every model-requested command was auto-approved without further validation. Fixed in Gemini CLI 0.39.1 and run-gemini-cli 0.1.22.
CVE-2026-54316 — Claude Code API Key Exfiltration
Novee found that Claude Code’s command validator strips single-quoted text before its 23 safety checks execute — correct bash semantics, but exploitable. A payload embedded in the value of the --receive-pack flag passed to git push reached the CI runner untouched. Separately, Novee demonstrated that Hugging Face’s public download counter could be used as a covert exfiltration channel, leaking an API key one character at a time. Every Claude Code release from 0.2.54 through 2.1.163 is affected. Anthropic rates the issue CVSS v4 6.0 (Moderate); NVD independently assigned CVSS v3.1 9.1 — the two scores are not directly comparable. Fixed in Claude Code 2.1.163.
OpenAI Codex — Instruction Hijack (No CVE)
The openai/codex repository ran two sequential Codex passes within a single shared job checkout. The first pass could write an AGENTS.md file that the second pass then loaded as its own instruction set. OpenAI’s position is that the sandbox functioned as documented; no version patch or CVE was issued.
Novee’s framing captures the systemic issue: “The harness is the code between the model and the real world.” In all three cases the vulnerability resided not in the model’s reasoning but in the surrounding orchestration layer — one component marked a value safe, a downstream component acted on it with greater authority.
Framework Mapping
- LLM02 (Insecure Output Handling): Agent harnesses failed to sanitise or re-validate model-influenced values before execution.
- LLM06 (Sensitive Information Disclosure): API keys exfiltrated via a covert side-channel in Claude Code.
- LLM07 (Insecure Plugin Design): Gemini CLI’s tool allowlist enforcement gap at runtime.
- LLM08 (Excessive Agency):
--yolomode granted unconditional command execution without runtime checks. - AML.T0051 (LLM Prompt Injection): Externally supplied GitHub issue content influenced agent behaviour.
- AML.T0057 (LLM Data Leakage): Covert exfiltration of CI secrets through a public API side-channel.
Impact Assessment
Any team running these agents in CI/CD pipelines where external contributors can open issues or pull requests is at risk of secret theft and arbitrary code execution on runner infrastructure. The Gemini host-execution bug required no model interaction at all — making it exploitable even in non-agentic configurations.
Mitigation & Recommendations
- Patch immediately: Upgrade to Gemini CLI ≥ 0.39.1, run-gemini-cli ≥ 0.1.22, and Claude Code ≥ 2.1.163.
- Audit externally triggerable workflows: Restrict which events (issues, PRs from forks) can initiate agent runs.
- Avoid
--yolomode in CI: Require explicit per-command approval or strict allowlisting enforced at runtime. - Isolate secrets: Use short-lived, scoped tokens for CI runners; rotate any secrets exposed in affected pipeline runs.
- Review harness code: Treat all agent orchestration logic as a security boundary, not boilerplate.