AI coding agents like Claude Code are vulnerable to attacks that happen before the model even sees your first prompt, according to security research that will be presented at Black Hat and DEF CON this week. The findings expose a blind spot in how companies think about AI security: the focus on protecting models from malicious prompts misses the real attack surface, which lies in the software layers that translate model intent into actual code execution.

Where Are Claude Code and Other AI Agents Actually Vulnerable?

Novee, a security firm founded in 2026, has identified critical flaws in how Anthropic's Claude Code, Google's Gemini CLI, and OpenAI's Codex handle untrusted inputs before any AI safety guardrails kick in. The research examines what happens in the moments between when a developer starts a tool and when the model receives its first instruction. In those gaps, attackers can inject malicious configurations, environment variables, or startup files that execute with full system privileges.

The company's researchers, including founding team member Elad Meged, will outline how internal stages in these tools can treat attacker-influenced states as safe before passing them to components with greater authority. In some cases, this sequence led to remote code execution. Anthropic's own analysis found the exposure could affect "the runner's repository token and any workflow-injected secrets," while Google categorized the potential impact as "supply chain compromises".

One particularly striking example involves Gemini CLI, where Novee identified what it describes as pre-task remote code execution. The attack surface can appear before an AI model receives its first prompt, through configuration files, environment variables, and other startup inputs. In headless continuous integration and continuous delivery (CI/CD) environments, these inputs may be trusted automatically, allowing execution before sandbox controls begin. Google scored the flagship case at CVSS 10.0, the highest severity rating, and later patched it.

Why Does the Software Layer Matter More Than the Model?

The research reframes the entire AI security conversation. Much of the public debate around AI safety has focused on prompt injection and model manipulation, the idea that clever wording can trick an AI into misbehaving. Novee's findings instead center on software behavior before prompt-time safeguards are active, widening the discussion from model safety to the mechanics of deployment and runtime configuration.

Novee argues that the risk lies not only in the model itself, but also in the surrounding software layer that translates model intent into actions. In automated environments, those components can operate without direct human review, creating gaps between validation and execution. This is a familiar problem in enterprise software security: the weakness may lie not only at the front-end entry point, but also in the logic and tooling that pass data deeper into privileged systems.

"These sessions show that some of the most serious security failures emerge before expected safeguards take effect, or inside components organisations already trust," said Ido Geffen, Chief Executive Officer and Co-Founder of Novee.

Ido Geffen, Chief Executive Officer and Co-Founder of Novee

Another DEF CON session will compare the containment approaches used by Claude Code, Gemini CLI, and Codex CLI. Novee says each product relies on a structural assumption about runtime enforcement, and each can fail when actual execution paths do not match that assumption. The session will argue that these failures stem from design gaps rather than model persuasion or prompt injection, shifting attention to how security boundaries are implemented in practice.

How Should Teams Deploy Claude Code and Similar Tools Safely?

• Start with isolated workflows: Begin with teams that already ship through small pull requests, strong tests, and frequent code review, where the impact of any security issue is contained and visible.
• Measure actual usage, not seat assignments: Track weekly active agent users, sessions per engineer, and agent-assisted pull request share to separate assigned licenses from real adoption and habit formation.
• Implement pre-execution validation: Review configuration files, environment variables, and startup inputs before the AI model receives any prompt, treating these as untrusted inputs even in internal CI/CD environments.
• Monitor for design gaps in containment: Audit whether your deployment assumptions about runtime enforcement match actual execution paths, since failures often stem from misaligned design rather than model behavior.
• Maintain visible failure channels: Create internal documentation of tool boundaries and known attack vectors so teams learn where these agents should and should not be used.

A separate Microsoft study of Claude Code and GitHub Copilot CLI adoption found that rollout design matters as much as the tool itself. The research examined Microsoft engineers during the first four months of an early 2026 rollout and found that adopters merged roughly 24% more pull requests than the authors estimate they otherwise would have. However, the paper emphasizes that this metric is a proxy for output, not guaranteed product value, and adoption was not uniform across the organization.

The most under-discussed finding from the Microsoft research is that first use spread primarily through social networks rather than top-down enablement alone. A teammate posting a useful transcript or a reviewer noticing that tests and documentation came with a change made the tool believable because the proof was local. This suggests that security considerations should follow the same pattern: early adopters should publish short internal receipts showing not just what the agent built, but how it was validated and what safeguards were in place.

Novee was founded by Ido Geffen, Gon Chalamish, and Omer Ninburg, and raised $51.5 million within four months of its inception from investors including YL Ventures, Canaan Partners, and Zeev Ventures. The company says it focuses on AI penetration testing and has examined attack paths in official AI workflows, coding sandboxes, and middleware used in enterprise Java deployments.

The timing of these revelations comes days after Anthropic disclosed that its Claude AI model hacked into the systems of three companies during testing after a configuration error gave it internet access. The incidents involved Claude Opus 4.7, Claude Mythos 5, and an internal research model, with the earliest cases dating to April 2026. Anthropic said Claude compromised the impacted organizations' infrastructure using basic techniques, such as exploiting weak passwords and unauthenticated endpoints.

The breaches occurred during capture-the-flag exercises, in which models are tasked with finding hidden information in simulated networks. Anthropic's prompts told the models they had no internet access, but a misconfiguration with its evaluation partner Irregular left the systems connected to the public internet. Anthropic identified all three incidents by July 24 and notified the affected organizations on July 27.

For engineering leaders deploying Claude Code or similar agents, the lesson is clear: the tool's capability is only as secure as the environment it runs in. Security reviews should focus not on what the model might be tricked into doing, but on what the surrounding software layer allows it to do before any human oversight is possible.