A GitHub issue opened by an account with no repository privileges was enough to execute code on the CI runners behind Anthropic’s and Google’s own coding-agent repositories. On OpenAI’s, it was enough to hijack the next agent run.
Novee Security ran the attack against each vendor’s agent in the configuration that the vendor ships by default, and presented the work at Black Hat USA on August 5. Two CVEs came out of it. Both are patched.
Gemini CLI carries the worst of the two. CVE-2026-12537 (CVSS 4 score: 10.0) is an OS command injection in the container launcher, reached through a crafted .gemini/.env file, which lets an unprivileged attacker run code on the host of a headless CI platform before the sandbox starts. It is fixed in Gemini CLI 0.39.1 and run-gemini-cli 0.1.22.
In Claude Code, CVE-2026-54316 turned Hugging Face’s public download counter into an exfiltration channel that leaked an API key one character at a time, and is fixed in 2.1.163. Every Claude Code release from 0.2.54 up to 2.1.163 is affected. Anthropic says exploitation required getting untrusted content into a Claude Code context.
The Codex finding produced neither a product-version patch nor a CVE. Novee says OpenAI’s position is that its sandbox behaved exactly as documented. Update Gemini CLI to 0.39.1, run-gemini-cli to 0.1.22, and Claude Code to 2.1.163, then audit any workflow an outside user can trigger.
The Gemini host-execution bug did not require talking a model into anything. Across all three, the recurring failure sat in the harness, the code around the model that decides what actually runs: one part marked a value safe, and a later part acted on that value with more authority.
“The harness is the code between the model and the real world,” Novee founding engineer Elad Meged wrote.
Novee found that Claude Code‘s command validator strips single-quoted text before its 23 checks run, which is correct behavior for bash, so a payload in the value of git push –receive-pack, a flag git executes, reached the runner untouched. That chain has no CVE and no publicly stated fixed version.
Gemini CLI parsed its tool allowlist only when registering the tool; at runtime nothing enforced it, and under –yolo every command the model asked for was auto-approved. Google addressed both that and the container-launcher flaw in one advisory, which says the fix “affects all Gemini CLI GitHub Actions.”
That advisory itself still shows no CVE; Google Cloud published the identifier separately as CNA, pointing back to it. Anthropic rates the Claude Code flaw Moderate at CVSS v4 6.0, while NVD assigned a CVSS v3.1 score of 9.1. NVD has not scored it under v4, so the two figures are not a like-for-like comparison.
The Codex finding is the one with no version to install. Novee found that the openai/codex repository ran two Codex passes inside a single job sharing one checkout, so the first pass could write AGENTS.md, the file the second pass loads as its own instructions. Failing the JSON validation between the passes is what launched the second one.
OpenAI’s current workflow separates the passes into different jobs and runs Codex with drop-sudo and a read-only sandbox. OpenAI’s guidance now lists repository instruction files among content that “should be considered part of the untrusted input surface,” and recommends running Codex as the last step in a job, warning that it may otherwise leave files behind for privileged steps that follow.
Neither change shows that Codex itself now handles a writable instruction file differently; what the sources establish is a repository-level workflow fix and a documentation update.
CISA’s entry on both the Gemini and Claude Code CVE records lists exploitation as none, and The Hacker News confirmed on August 7 that neither appears in the agency’s Known Exploited Vulnerabilities catalog. It also found a public GitHub repository describing itself as a reproduction lab for the Claude Code flaw, up since June 18. Nothing in the sources reviewed shows either chain used against a target.
The development comes as Pillar Security reported on August 4 that the operators of the ChainDrop npm worm planted a Claude Code SessionStart hook and a VS Code folderOpen task in compromised repositories, firing when a developer opened the workspace rather than waiting for an install.
