Anthropic's Claude Code and Google's Gemini CLI contain critical security flaws that allow attackers with no repository access to execute code on continuous integration runners and steal sensitive credentials. Researchers at Novee Security demonstrated the attacks at Black Hat USA on August 5, revealing that both tools fail to properly validate untrusted input before passing it to the underlying system.

What Are the Specific Vulnerabilities in These AI Coding Tools?

The security issues stem from flaws in the "harness," the code layer between the AI model and the actual system commands it executes. Novee Security's founding engineer Elad Meged explained the core problem: "The harness is the code between the model and the real world." In both tools, one part of the code marked a value as safe, but a later part acted on that value with greater authority, creating a dangerous gap.

Google's Gemini CLI carries the most severe flaw. Identified as CVE-2026-12537 with a CVSS score of 10.0, the vulnerability is an operating system command injection in the container launcher. An attacker can craft a malicious.gemini/.env file that executes code on the host machine before the sandbox even starts, giving them full system access. The flaw affects every version of Gemini CLI before 0.39.1 and run-gemini-cli before 0.1.22.

Claude Code's vulnerability, CVE-2026-54316, is more subtle but equally dangerous. The flaw turns Hugging Face's public download counter into an exfiltration channel, leaking API keys one character at a time. Every Claude Code release from version 0.2.54 through 2.1.163 is vulnerable. Anthropic rates this as a moderate severity issue, though the National Vulnerability Database assigned it a CVSS v3.1 score of 9.1, indicating serious risk.

How Can Developers Protect Their CI Workflows From These Attacks?

• Update Immediately: Upgrade Gemini CLI to version 0.39.1 or later, run-gemini-cli to 0.1.22 or later, and Claude Code to version 2.1.163 or later to patch the known vulnerabilities.
• Audit External Triggers: Review any workflow that an outside user or untrusted account can trigger, such as GitHub issues or pull requests from public repositories, and restrict their ability to invoke AI coding agents.
• Isolate Instruction Files: Treat repository instruction files as untrusted input, and run AI agents as the last step in a CI job to prevent them from leaving malicious files for privileged steps that follow.
• Enforce Sandbox Controls: Run coding agents with drop-sudo privileges and read-only sandboxes to limit the damage if an attack succeeds.
• Separate Job Execution: If using multiple passes of an AI agent in a single workflow, run them in separate jobs with isolated checkouts to prevent one pass from modifying instructions for the next.

The attack chain is straightforward and requires minimal technical sophistication. An attacker opens a GitHub issue on a public repository with no special permissions. The issue content reaches the AI agent's context, which then executes a crafted command that the harness fails to properly validate. On Anthropic's and Google's own repositories, this was enough to run arbitrary code on their CI runners. On OpenAI's Codex, it was enough to hijack the next agent run.

Novee Security tested each vendor's agent in the default configuration they ship to customers, making the findings particularly relevant for organizations already using these tools. The researchers presented their work at Black Hat USA, one of the security industry's most prestigious conferences, ensuring the findings reached a wide audience of security professionals.

What Do the Vendors Say About These Flaws?

Both Anthropic and Google have released patches, but their responses differ in scope and transparency. Google addressed the Gemini CLI flaws in a single advisory that affects all Gemini CLI GitHub Actions, though the advisory initially carried no CVE identifier. Google Cloud later published the CVE separately as a CNA (CVE Numbering Authority).

Anthropic's response to Claude Code is more limited. The company states that exploitation required getting untrusted content into a Claude Code context, which is technically true but understates the risk, since GitHub issues and pull request comments are common sources of untrusted input in CI workflows. Additionally, Novee Security found a separate flaw in Claude Code's command validator that strips single-quoted text before running security checks. This allows payloads hidden in git flags to reach the runner untouched, but Anthropic has not issued a CVE or publicly stated a fixed version for this issue.

OpenAI's Codex faced a different type of flaw. The vulnerability allowed the first pass of a two-pass workflow to write an instruction file that the second pass would load and execute. OpenAI has since separated the passes into different jobs and runs Codex with drop-sudo and a read-only sandbox. However, OpenAI did not issue a CVE or version patch; instead, the company updated its documentation to list repository instruction files as part of the "untrusted input surface" and recommends running Codex as the last step in a job.

As of August 7, neither the Gemini CLI nor Claude Code vulnerabilities appear in the Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities catalog, and no public evidence shows these flaws have been used in active attacks. However, Pillar Security reported on August 4 that operators of the ChainDrop npm worm planted Claude Code SessionStart hooks in compromised repositories, demonstrating that attackers are actively targeting the AI coding ecosystem.

The timing of these disclosures comes as AI coding agents become increasingly integrated into enterprise development workflows. Unlike traditional code review tools, these agents execute commands directly on CI runners with access to secrets, credentials, and production deployment pipelines. The vulnerabilities highlight a critical gap: the harness layer that connects AI models to real-world systems must be as carefully secured as the model itself, or the entire system becomes a liability.