Claude Code and Gemini CLI Flaws Let a GitHub Issue Reach CI Workflow Secrets
10:18 · August 7, 2026 · Hacker News AI Section
A GitHub issue opened by an account with no repository privileges was enough to execute code on the CI runners behind Anthropic's and Google's own coding-agent repositories. On OpenAI's, it was enough to hijack the next agent run. Novee Security ran the attack against each vendor's agent in the configuration that the vendor ships by default, and presented the work at Black Hat USA on August 5.
Summary
Novee Security researchers demonstrated that a GitHub issue created by an unprivileged account could trigger code execution on the CI runners of Anthropic’s and Google’s own coding-agent repositories, while OpenAI’s Codex setup allowed the next agent invocation to be hijacked. The findings, presented at Black Hat USA on 5 August, identified two CVEs that have since been patched and highlighted recurring weaknesses in the harnesses that sit between the language model and the execution environment.
Gemini CLI proved the most severe case. CVE-2026-12537, scored 10.0 under CVSS v4, stemmed from an OS command injection in the container launcher. An attacker could supply a crafted .gemini/.env file that executed arbitrary commands on the host before any sandbox was initialised. The flaw was addressed in Gemini CLI 0.39.1 and run-gemini-cli 0.1.22. Additional issues included an allow-list that was evaluated only at tool registration and full auto-approval under the --yolo flag.
Claude Code contained CVE-2026-54316, which enabled data exfiltration by turning Hugging Face’s public download counter into a side channel. A single API key could be leaked one character at a time. The vulnerability affected every release from 0.2.54 through 2.1.163 and was fixed in the latter version. A separate command-validation flaw, which stripped single-quoted strings before 23 security checks ran, allowed payloads such as the --receive-pack argument to git push to reach the runner; that path received no CVE.
OpenAI’s Codex repository did not receive a product patch or CVE. Its workflow executed two Codex passes inside the same job and shared checkout, permitting the first pass to write an AGENTS.md file that the second pass would load as instructions. OpenAI has since separated the passes into distinct jobs, added drop-sudo and a read-only sandbox, and updated its guidance to treat repository instruction files as untrusted input.
Across all three systems the core problem resided in the harness rather than the model itself: one component marked a value as safe while a later component acted on it with elevated authority. CISA records list no known exploitation for the two CVEs, and neither appears in the agency’s Known Exploited Vulnerabilities catalogue.
Why it matters
Directly actionable for Dutch security teams using these AI coding agents in CI/CD pipelines; provides concrete patches, CVSS scores, and audit guidance aligned with EU AI security and data-protection needs.
