Press play to start listening
A public GitHub issue opened by an outside user with no repository privileges could have turned AI coding tools from Anthropic, Google and OpenAI against the repositories they were meant to maintain, according to research presented by Novee Security at Black Hat USA 2026.
Researchers tested Claude Code, Gemini CLI and Codex using the vendors’ own repositories and default workflow configurations. They found paths to remote code execution, credential theft, repository modification and instructions that persisted between separate agent runs.
During these workflows, coding agents read GitHub issues or pull requests and perform tasks such as identifying duplicate reports, reviewing code or managing repositories. The danger appears when text supplied by an outsider reaches an agent with access to command-line tools, repository tokens, or other credentials.
Claude Code Required Three Corrections
With Claude Code, Novee first found that an attacker could place hidden instructions inside a GitHub issue and ask the agent to run a specially prepared git push command. The command passed Anthropic’s validation checks but abused Git’s receive-pack option to execute code on the GitHub Actions runner.
That access could expose the workflow’s GitHub and Anthropic API tokens. Depending on the permissions assigned to the GitHub token, an attacker could also modify workflows or publish altered packages under the affected repository’s namespace.
After Anthropic blocked that route, Novee found further methods involving unrestricted file reads and data theft. The final issue, tracked as CVE-2026-54316, abused Claude Code’s pre-approved access to Hugging Face.
According to Novee Security’s report shared with Hackread.com, an attacker could instruct Claude to make requests to an attacker-controlled Hugging Face repository and encode stolen information into those requests.
By monitoring download counts on repositories they controlled, an attacker could reconstruct the stolen information. The flaw affects Claude Code versions 0.2.54 through 2.1.162 and was fixed in version 2.1.163.
Gemini CLI Flaw Receives Maximum CVSS Score
Google’s case began with a tool restriction that appeared to permit only echo and a GitHub issue-viewing command. Novee found that Gemini CLI registered the full shell tool without enforcing the command-specific restriction during execution.
Although sensitive variables were removed from child processes, those secrets remained inside the parent Gemini CLI process. Because both processes shared the same user and process namespace, commands could read the parent environment through Linux’s /proc filesystem and obtain the GitHub token, Gemini API key, and other credentials.
Google rated the issue critical with a CVSS score of 10.0. The affected software includes Gemini CLI versions before 0.39.1, preview versions before 0.40.0-preview.3, and run-gemini-cli GitHub Action versions before 0.1.22. The impact is limited to headless workflows that process untrusted content under the affected settings.
Codex Instructions Persisted Between Agent Runs
OpenAI’s Codex issue-deduplication workflow ran two agents inside the same writable workspace. Novee found that the first agent could be manipulated into creating an AGENTS.md file, which Codex automatically reads as project instructions during its next run.
When the second agent started, it accepted the attacker-written file as trusted instructions. This allowed influence from the first stage to persist even though the workflow checked and rejected its direct output.
OpenAI corrected its repository within three days by separating the agent runs into different jobs and checkouts, then moving them into read-only environments. OpenAI said the Codex sandbox operated as documented. The company corrected its own repository, but those changes did not automatically fix similar workflows created by other organizations.
Novee found comparable configurations in more than 100 public repositories. The report describes controlled proof-of-concept testing and does not report malicious exploitation.
Companies using these tools should install the corrected Claude Code and Gemini CLI versions, review workflows triggered by public issues or pull requests, prevent separate agents from sharing writable directories, and limit tokens to the permissions required for each task.
