AI coding agents have moved fast from novelty to default infrastructure: teams wire them into GitHub Actions to triage issues, review pull requests, and even push fixes automatically. Research presented at Black Hat USA on 5 August by Novee shows what happens when the trust boundary around that automation is thinner than it looks, an attacker with no repository access at all, just the ability to open a public GitHub issue, could get code running on the vendor’s own build infrastructure.
The same failure pattern, three times
Novee researcher Elad Meged tested Anthropic’s Claude Code, Google’s Gemini CLI, and OpenAI’s Codex against each vendor’s own public repositories, running each agent in the exact default configuration the vendor ships. In Claude Code Action’s tag mode, a Git flag whose quoted value was hidden from the tool’s command validator but still executed by Git let a prompt-injection payload buried in a GitHub issue reach remote code execution on the runner, exposing the GITHUB_TOKEN and any workflow-injected API keys. It took three rounds of patch and bypass before Anthropic closed it fully, tracked as CVE-2026-54316 and fixed in Claude Code 2.1.163. Gemini CLI’s flaw was worse on paper: CVE-2026-12537, an OS command injection in the container launcher reachable through a crafted .gemini/.env file, scored a perfect CVSS 10.0, letting an unprivileged attacker run code on a headless CI host before the sandbox even started. It is fixed in Gemini CLI 0.39.1.
The bugs were never in the model
The pattern across all three vendors is the same: one component in the agent’s harness, the surrounding code that manages permissions, sandboxing, and tool execution, marked attacker-influenced input as safe, and a downstream component consumed it with more authority than it should have had. None of this required tricking the underlying language model into doing something it shouldn’t; it required finding the seam where the scaffolding around the model trusted something it shouldn’t have. That distinction matters for anyone evaluating these tools: model-level safety testing does not cover harness-level trust boundary bugs, and this research is a live demonstration of why both need separate scrutiny.
What this means if your team already wired one of these in
All three vendors have shipped fixes, but the exposure window was real, and it applied to exactly the configuration most teams actually run: the vendor’s documented default. European engineering organisations that adopted Claude Code, Gemini CLI, or Codex in GitHub Actions over the past year should treat this as the prompt to audit what secrets those workflows had access to, whether GITHUB_TOKEN scopes were broader than necessary, and whether any anomalous runner activity coincided with the exposure window. This is also a useful data point for teams weighing AI coding agents against the EU AI Act’s governance expectations, the risk sits in the operational integration, not just the model.
If your organisation runs AI coding agents in CI/CD and wants a security review of what they can actually reach, or help scoping GitHub Actions permissions and secrets down to least privilege, contact Excello Digital. We help European teams adopt AI development tooling without handing attackers a shortcut into the pipeline.