Patched flaws in AI coding CLIs exposed CI runners to issue-driven attacks

Novee Security reported that a GitHub issue opened by an account without repository privileges could execute code on continuous-integration runners used by Anthropic and Google coding-agent repositories in their shipped default configurations. The researchers also found a workflow path affecting OpenAI's Codex repository, where the next agent pass could be influenced. The work was presented at Black Hat USA on August 5, and two CVEs were assigned and patched.

The most severe issue is CVE-2026-12537, an OS command injection in Gemini CLI's container launcher with a CVSS v4 score of 10.0. A crafted .gemini/.env file could allow an unprivileged attacker to run code on the host of a headless CI platform before the sandbox begins. Google fixed the issue in Gemini CLI 0.39.1 and run-gemini-cli 0.1.22.

Harness controls became the security boundary

Novee's findings focus on the harness: the code surrounding an AI model that determines what is actually executed. In each chain, a value was regarded as safe at one stage and was later used with more authority. The Gemini host-execution path did not depend on persuading a model to perform an action.

Researchers also found that Gemini CLI parsed its tool allowlist during tool registration, while runtime enforcement was absent. With --yolo, commands requested by the model were automatically approved. Google's advisory addressed both this behavior and the container-launcher issue, saying its fix affects all Gemini CLI GitHub Actions.

Claude Code and Codex workflow paths

Anthropic fixed CVE-2026-54316 in Claude Code 2.1.163. The flaw used Hugging Face's public download counter as an exfiltration channel, leaking an API key one character at a time. Anthropic said exploitation required untrusted content to enter a Claude Code context. Releases from 0.2.54 through 2.1.163 were affected.

Novee also described a command-validation path in Claude Code involving single-quoted text and the value of git push --receive-pack. That chain has no CVE and no publicly stated fixed version. The research follows agent activity involving Hugging Face on agent activity involving Hugging Face, where untrusted inputs and automation boundaries were also central to the risk.

For Codex, Novee found that two passes ran in one job with a shared checkout. The first could write AGENTS.md, which the second loaded as instructions after JSON validation failed. OpenAI's current workflow places the passes in separate jobs and uses drop-sudo with a read-only sandbox. Its guidance also treats repository instruction files as untrusted input and recommends making Codex the final job step.

Required operational response

CISA lists exploitation as none for the Gemini and Claude Code CVEs, and neither was in its Known Exploited Vulnerabilities catalog as of August 7. Organizations should update Gemini CLI, run-gemini-cli and Claude Code to the stated fixed releases, then examine workflows that outsiders can trigger for shared workspaces, writable instruction files and execution paths that precede sandbox controls.