Security researchers demonstrated that AI coding agents from Anthropic, Google, and OpenAI can be turned against the repositories they're meant to protect through specially crafted GitHub issues. The findings, presented at Black Hat USA 2026 by Novee Security, expose a critical vulnerability class affecting how these tools handle untrusted input from public repositories.

What Makes AI Coding Agents Vulnerable to GitHub Attacks?

AI coding agents like Claude Code are designed to automate routine development tasks: they read GitHub issues and pull requests, identify duplicate reports, review code, and manage repositories. The danger emerges when an attacker places hidden instructions inside a public GitHub issue. When the agent processes that issue with access to command-line tools, repository tokens, or API credentials, it becomes a potential attack vector.

Novee Security tested Claude Code, Gemini CLI, and Codex using the vendors' own repositories and default workflow configurations. Researchers found paths to remote code execution, credential theft, repository modification, and instructions that persisted between separate agent runs. The research involved controlled proof-of-concept testing and did not report any malicious exploitation.

How Did Researchers Compromise Claude Code?

Novee Security discovered multiple attack pathways against Claude Code. Initially, researchers found that an attacker could place hidden instructions inside a GitHub issue and ask the agent to run a specially prepared git push command. The command passed Anthropic's validation checks but abused Git's receive-pack option to execute code on the GitHub Actions runner, potentially exposing the workflow's GitHub and Anthropic API tokens.

After Anthropic blocked that route, Novee found further methods involving unrestricted file reads and data theft. The final critical issue, tracked as CVE-2026-54316, abused Claude Code's pre-approved access to Hugging Face, a popular platform for sharing machine learning models. An attacker could instruct Claude to make requests to an attacker-controlled Hugging Face repository and encode stolen information into those requests. By monitoring download counts on repositories they controlled, an attacker could reconstruct the stolen data. The flaw affected Claude Code versions 0.2.54 through 2.1.162 and was fixed in version 2.1.163.

What Vulnerabilities Affected Google's Gemini CLI?

Google's case began with a tool restriction that appeared to permit only echo and a GitHub issue-viewing command. Novee found that Gemini CLI registered the full shell tool without enforcing the command-specific restriction during execution. Although sensitive variables were removed from child processes, those secrets remained inside the parent Gemini CLI process.

Because both processes shared the same user and process namespace, commands could read the parent environment through Linux's /proc filesystem and obtain the GitHub token, Gemini API key, and other credentials. Google rated the issue critical with a CVSS score of 10.0, the highest severity rating. The affected software includes Gemini CLI versions before 0.39.1, preview versions before 0.40.0-preview.3, and run-gemini-cli GitHub Action versions before 0.1.22. The impact is limited to headless workflows that process untrusted content under the affected settings.

How Did OpenAI's Codex Fail to Isolate Agent Runs?

OpenAI's Codex issue-deduplication workflow ran two agents inside the same writable workspace. Novee found that the first agent could be manipulated into creating an AGENTS.md file, which Codex automatically reads as project instructions during its next run. When the second agent started, it accepted the attacker-written file as trusted instructions. This allowed influence from the first stage to persist even though the workflow checked and rejected its direct output.

OpenAI corrected its repository within three days by separating the agent runs into different jobs and checkouts, then moving them into read-only environments. OpenAI stated that the Codex sandbox operated as documented. However, the company's corrected repository changes did not automatically fix similar workflows created by other organizations. Novee found comparable configurations in more than 100 public repositories.

Steps to Secure Your AI Coding Workflows

• Update Software Immediately: Install the corrected Claude Code and Gemini CLI versions to patch the identified vulnerabilities and prevent exploitation through GitHub issues.
• Review Public-Facing Workflows: Audit workflows triggered by public issues or pull requests to identify where untrusted input reaches your agents with elevated permissions.
• Isolate Agent Workspaces: Prevent separate agents from sharing writable directories, and move agent runs into read-only environments whenever possible to block persistence attacks.
• Limit Token Permissions: Restrict API tokens and GitHub tokens to the minimum permissions required for each specific task, reducing the blast radius if credentials are compromised.

The research underscores a broader challenge in AI-assisted development: as coding agents gain more autonomy and access to sensitive systems, they become attractive targets for attackers who can inject malicious instructions through public channels. The fact that researchers found comparable vulnerable configurations in more than 100 public repositories suggests this is not an isolated problem but a systemic issue affecting how organizations deploy AI coding tools.

For development teams using Claude Code, Gemini CLI, or Codex in production environments, the immediate priority is updating to patched versions and reviewing how these tools interact with public repositories. The longer-term challenge involves rethinking how AI agents should handle untrusted input and designing workflows that assume agents may be compromised rather than trusting them implicitly with repository access.