Security firm Novee found that a GitHub issue opened by an account with zero repository privileges was enough to execute code on the CI runners behind Anthropic's and Google's own coding-agent repositories. Founding engineer Elad Meged presented the findings at Black Hat USA on August 5, testing each vendor's agent in the configuration it ships by default.
Gemini CLI's flaw, CVE-2026-12537, scored a maximum CVSS of 10.0: a crafted .gemini/.env file triggered OS command injection, letting an unprivileged attacker run code on a CI host before the sandbox even started. Claude Code's issue, CVE-2026-54316, let attackers exfiltrate API keys character-by-character via a Hugging Face download-counter side channel, hidden inside a specially prepared git push command that passed Anthropic's validation checks. OpenAI's Codex had no CVE, but a related flaw let one agent pass modify instructions read by a second pass sharing the same checkout.
Google patched Gemini CLI in version 0.39.1, and Anthropic fixed Claude Code in 2.1.163. CISA lists no known exploitation of either flaw in the wild. "The harness is the code between the model and the real world," Meged said — the vulnerabilities recurred because one component marked values as safe while a later, more powerful component acted on them anyway.