Security researchers showed last week how a single GitHub issue from an account with zero repository access could expose workflow secrets in the CI pipelines of three major AI coding tools. The findings, presented at Black Hat USA on August 5, targeted Anthropic’s Claude Code, Google’s Gemini CLI and OpenAI’s Codex. Patches followed quickly. Yet the underlying pattern runs deeper than any one vendor’s code.
Elad Meged of Novee Security led the work. He described the core problem simply. “The harness is the code between the model and the real world,” Meged wrote. That harness repeatedly failed to keep untrusted GitHub content from reaching privileged execution environments. The result? Remote code execution on CI runners, credential theft and, in one case, a clever side-channel exfiltration using public download counters.
The Hacker News first broke the story on August 7. Its coverage detailed the two CVEs assigned and noted that comparable default configurations existed in well over a hundred other public repositories. The Cloud Security Alliance followed with a research note on August 8 that expanded on the technical chains and placed the bugs in the broader context of agentic AI security. CSA researchers highlighted that the vulnerabilities lived in validation logic and environment handling, not in the large language models themselves.
Start with Gemini CLI. It earned the maximum CVSS v4 score of 10.0 under CVE-2026-12537. The flaw combined automatic workspace trust in headless CI mode with an allowlist checked only at tool registration. Nothing enforced it at runtime. An attacker could therefore push a crafted .gemini/.env file inside a pull request. The container launcher would interpret that file before any sandbox started. Arbitrary OS commands ran on the host.
Even after sanitization of child-process environments, the parent process environment stayed readable. Linux’s /proc filesystem gave the attacker a direct view of GITHUB_TOKEN, GEMINI_API_KEY and other credentials. Google fixed the issues in Gemini CLI 0.39.1, a preview release and the companion run-gemini-cli GitHub Action version 0.1.22. The company also updated its own advisory database entry. The GitHub advisory frames the change as a breaking adjustment to headless trust behavior.
Claude Code took a different path to compromise. Early bypasses relied on a validator that stripped single-quoted strings before applying its checks. A payload hidden inside git push –receive-pack slipped through untouched. Anthropic patched that vector. Researchers then used commands on a read-only allowlist such as tac to read environment files anyway. The final, CVE-tracked variant turned to Hugging Face.
Because the WebFetch tool pre-approved huggingface.co, Claude could create dozens of model repositories. Each represented one possible character in an API key. Public download counters on those repositories became an oracle. Incrementing the right counter leaked the next secret character. The technique required getting untrusted content into Claude’s context first. Still, it worked against the vendor’s own default workflow. CVE-2026-54316 covers the issue. Anthropic rated it moderate under CVSS v4 at 6.0. The National Vulnerability Database scored the same bug 9.1 under the older v3.1 scale. The fix arrived in Claude Code 2.1.163. Every release from 0.2.54 onward had been exposed.
OpenAI’s Codex avoided a CVE altogether. Its multi-pass architecture inside a single shared workspace let the first agent invocation write an AGENTS.md instruction file. A subsequent invocation would load and trust that file as authoritative context. OpenAI called the behavior documented and expected. The company did harden its own issue-deduplicator workflow within days. Organizations running similar two-pass designs now face a workflow redesign rather than a simple upgrade.
These three cases share more than a trigger. Each assumes GitHub issue or pull-request content can safely reach an agent granted tools and secrets. Aonan Guan’s earlier “Comment and Control” research, published in April, had already shown prompt injection through PR titles, issue bodies and even hidden HTML comments could hijack Claude Code Security Review, Gemini CLI Action and GitHub Copilot Agent. Guan demonstrated credential theft via ps auxeww and base64-encoded commits. The Novee work built on that foundation but focused on the harness failures that let untrusted input become executed commands or exfiltrated data.
Penligent’s analysis of the Gemini advisory reinforced the point. Workspace trust combined with YOLO-style tool approval created a perfect storm in non-interactive environments. The post recommended explicit trust settings, read-only tool lists and avoidance of generic shell execution. It also noted that over two million monthly installs of the Gemini CLI package could have been affected had the flaw been exploited at scale. No public evidence of active exploitation has surfaced. CISA’s Known Exploited Vulnerabilities catalog still lists none for either CVE as of mid-August.
Yet the exposure is broader than the three vendors. The Cloud Security Alliance reported finding more than one hundred public repositories with functionally identical default configurations. Many copied the reference workflows shipped by Anthropic, Google or OpenAI. That replication turns a trio of bugs into an industry pattern. Similar issues have appeared in earlier research on Clinejection, GhostCommit and GuardFall. All point to the same structural gap: string-level validation that fails once a real shell or filesystem interprets the command.
Vendors responded with speed. Google treated the report through its Vulnerability Rewards Program and credited both Meged and Dan Lisichkin of Pillar Security. Anthropic issued the 2.1.163 release and updated its security guidance to warn that content sanitizers can be bypassed. The company now advises human review of external contributor input before letting Claude act on it. OpenAI adjusted its own repository workflows without issuing a CVE. All three have encouraged users to audit any GitHub Action or workflow that external users can trigger.
For security teams the lesson is immediate. Update Gemini CLI to at least 0.39.1 and run-gemini-cli to 0.1.22. Upgrade Claude Code to 2.1.163 or later. Then examine every automated response to issues, pull requests or comments. Look for shared workspaces across multiple agent passes. Check whether tools run with write access or network reach to external services. Consider ephemeral runners, least-privilege tokens and manual approval gates for public repositories.
The incidents also expose a philosophical tension. AI coding agents promise to remove humans from routine triage and code maintenance. That removal simultaneously eliminates the last checkpoint that would question a stranger’s GitHub issue. When the model’s output feeds directly into shell execution or file writes inside a privileged CI job, the harness must carry the full burden of defense. So far that burden has proved heavier than many assumed.
Recent coverage adds weight to the warnings. SecurityWeek reported in April on prompt injection against the same agents via comments, showing the attack surface has been visible for months. Its article quoted confirmed exploits against Claude, Gemini and Copilot that resulted in token theft. X posts in the days after the Black Hat disclosure echoed the urgency. One developer noted that the new vector means “the agent” itself has become part of the attack surface. Another warned teams to patch before Monday.
Industry observers expect more disclosures. As organizations wire additional agents into CI/CD pipelines, the combination of untrusted GitHub events, persistent workspaces and powerful tools will surface new bypasses. The fixes already released address the specific flaws Novee demonstrated. They do not eliminate the class of problem. That will require systematic changes in how agents declare trust boundaries, how workflows isolate passes and how secrets reach execution contexts.
Security and platform teams should treat these agents like any other privileged service. Assume external input is hostile. Validate at the point of execution rather than registration. Separate read and write operations. And never let a single GitHub issue become the sole trigger for code that runs with repository secrets. The research makes clear the cost of getting that assumption wrong.