A Single GitHub Issue Reached the CI Secrets of Claude Code and Gemini CLI

On August 5, at the Black Hat USA conference, Novee Security demonstrated that a bundle of familiar automation tools can turn into a full-blown attack chain. Each vendor's agent was attacked in precisely the configuration the vendor ships by default. The starting point was an ordinary GitHub Issue, opened by an account with no privileges whatsoever in the repository.

Three agents, three outcomes

Google's outcome was the most severe. The vulnerability CVE-2026-12537 (CVSS 4: 10.0) is an OS command injection in the container launcher, reachable through a crafted .gemini/.env file. It let an unauthorized attacker execute code on the host of the headless CI platform even before the sandbox started. And doing so required no “persuading” of the model whatsoever. Fixed in Gemini CLI 0.39.1 and run-gemini-cli 0.1.22.

In Claude Code, the vulnerability CVE-2026-54316 turned the public Hugging Face download counter into a leak channel: the API key seeped out one character at a time. All releases from 0.2.54 through 2.1.163 are affected, and it is in the latter that the flaw is fixed. According to Anthropic, exploitation required smuggling untrusted content into Claude Code's context. Anthropic rates the problem as “moderate” (CVSS v4 6.0), whereas the NVD assigned it a 9.1 under v3.1 — the scales differ, so the numbers are not directly comparable.

OpenAI got neither a version patch nor a CVE: the company's position is that the sandbox behaved exactly as documented.

The problem is in the “harness,” not the model

The common flaw, recurring across all three, sat not in the models themselves but in the harness — the code around the model that decides what actually gets run. As Novee's lead engineer Elad Meged put it, “the harness is the code between the model and the real world.” The mechanics were similar everywhere: one part of the system marked a value as safe, while another later acted on it with greater privileges. For instance, Claude Code's command validator correctly stripped out single-quoted text for bash before its 23 checks — and the malicious payload in the git push --receive-pack flag reached the runner untouched.

In OpenAI's repository, two Codex passes ran in a single job with a shared working copy: the first pass could write an AGENTS.md file, which the second then loaded as its own instructions. OpenAI now splits the passes across separate jobs and explicitly treats repository instruction files as an untrusted input surface.

No exploitation “in the wild” recorded

According to CISA, neither CVE is in the catalog of actively exploited vulnerabilities; The Hacker News confirmed this on August 7. At the same time, since June 18 a public repository has existed on GitHub, calling itself a lab for reproducing the Claude Code bug. The recommendation is simple: update Gemini CLI to 0.39.1, run-gemini-cli to 0.1.22 and Claude Code to 2.1.163, then review all workflows that an external user can trigger.

Source: The Hacker News