Full Report
A GitHub issue opened by an account with no repository privileges was enough to execute code on the CI runners behind Anthropic's and Google's own coding-agent repositories. On OpenAI's, it was enough to hijack the next agent run. Novee Security ran the attack against each vendor's agent in the configuration that the vendor ships by default, and presented the work at Black Hat USA on August 5.
Analysis Summary
# Vulnerability: RCE and Data Exfiltration in AI Coding Agents (Anthropic, Google, OpenAI)
## CVE Details
- **CVE ID:** CVE-2026-12537 (Google Gemini CLI) / CVE-2026-54316 (Anthropic Claude Code)
- **CVSS Score:** 10.0 (Critical - Google) / 9.1 (Critical - NVD for Anthropic) / 6.0 (Moderate - Anthropic rating)
- **CWE:** OS Command Injection; Improper Input Validation; Information Exposure
## Affected Systems
- **Products:**
- Google: Gemini CLI and `run-gemini-cli` GitHub Actions.
- Anthropic: Claude Code.
- OpenAI: Codex (specifically the `openai/codex` repository workflow).
- **Versions:**
- Gemini CLI: All versions prior to 0.39.1.
- Claude Code: Versions 0.2.54 through 2.1.163.
- **Configurations:** Default configurations where coding agents interact with untrusted content (e.g., GitHub issues) or headless CI environments.
## Vulnerability Description
The flaws reside in the "harness"—the wrapper code between the AI model and the host environment.
- **Google (CVE-2026-12537):** An OS command injection in the container launcher via a crafted `.gemini/.env` file. This allows code execution on the CI host *before* the sandbox even starts. Additionally, the tool allowlist was only checked during registration, not at runtime, allowing models to execute unapproved commands under certain flags.
- **Anthropic (CVE-2026-54316):** Untrusted input (like a GitHub issue) could be manipulated to bypass command validation. In one instance, a payload in a git flag bypassed checks because the validator stripped single-quoted text. This enabled data exfiltration, including leaking API keys character-by-character via Hugging Face download counters.
- **OpenAI (Codex):** A workflow flaw where two Codex passes shared a single job and a writable checkout. An unprivileged attacker could write a malicious `AGENTS.md` file in the first pass to hijack the instructions for the second pass.
## Exploitation
- **Status:** PoC demonstrated by Novee Security at Black Hat USA 2026; not currently seen in the wild.
- **Complexity:** Medium (requires knowledge of CI workflow triggers and agent prompt injection/instruction hijacking).
- **Attack Vector:** Network (unprivileged GitHub issues/PRs).
## Impact
- **Confidentiality:** High (exfiltration of CI secrets and API keys).
- **Integrity:** High (arbitrary code execution on CI runners; hijacking of agent instructions).
- **Availability:** High (full host takeover in the case of Google's flaw).
## Remediation
### Patches
- **Google:** Update Gemini CLI to **0.39.1** and `run-gemini-cli` to **0.1.22**.
- **Anthropic:** Update Claude Code to **2.1.163** or later.
### Workarounds
- **OpenAI:** No specific product patch was issued; instead, users must update their GitHub Action workflows to separate passes into different jobs, use `drop-sudo`, and implement a read-only sandbox.
- **General:** Limit AI agents' access to sensitive environment variables and ensure they run as the final step in a job to prevent leaving malicious files for subsequent privileged steps.
## Detection
- **Indicators of Compromise:** Unusual activity in CI runners, unauthorized calls to external APIs (like Hugging Face download counters), or unexpected modifications to `.env` or instruction files (`AGENTS.md`) within repositories.
- **Detection Methods:** Audit CI logs for workflows triggered by external users (issues/PRs). Monitor for command-line arguments containing nested quotes or shell escapes in agent logs.
## References
- **Google Advisory:** hxxps://github[.]com/google-github-actions/run-gemini-cli/security/advisories/GHSA-wpqr-6v78-jr5g
- **Anthropic Advisory:** hxxps://github[.]com/勇敢的/claude-code/security/advisories/GHSA-fg94-h982-f3mm
- **Novee Security Research:** hxxps://novee[.]security/blog/critical-flaws-in-anthropic-google-and-openais-coding-agents/
- **NVD Record (Google):** hxxps://nvd[.]nist[.]gov/vuln/detail/CVE-2026-12537
- **NVD Record (Anthropic):** hxxps://nvd[.]nist[.]gov/vuln/detail/CVE-2026-54316