Novee Discloses Flaws in Major Coding Agents
Novee researchers disclosed at Black Hat USA 2026 attack paths affecting Anthropic Claude Code, Google Gemini CLI, and OpenAI Codex. Hackread reports that untrusted GitHub issue or pull-request content could reach agents with command-line tools and repository credentials, enabling scenarios including remote code execution, credential theft, repository modification, and persistent cross-run instructions.
Novee researchers disclosed security flaws affecting Anthropic Claude Code, Google Gemini CLI, and OpenAI Codex at Black Hat USA 2026. Hackread reports that the researchers tested the tools against the vendors' repositories and default workflow configurations, finding attack paths from externally submitted GitHub issues or pull requests to remote code execution, credential theft, repository modification, and instructions that could persist across agent runs.
The central exposure described in the report is an agentic workflow that ingests untrusted repository text while holding access to command-line tools, repository tokens, or other credentials. This differs from a conventional prompt-injection demonstration because the reported impact depends on the agent being embedded in an operational automation pipeline with authority to read, execute, and modify.
Reported Claude Code attack path
Hackread reports that Novee's initial Claude Code finding used hidden instructions in a GitHub issue to induce execution of a prepared git push command. The command reportedly passed Anthropic validation but abused Git's receive-pack option to execute code on a GitHub Actions runner.
According to Hackread, access to that runner could expose GitHub and Anthropic API tokens. The report adds that, depending on GitHub token permissions, an attacker could alter workflows or publish modified packages under the affected repository namespace. After Anthropic blocked the initial route, Novee found additional methods involving unrestricted file reads and credential theft, Hackread reports. The final reported Claude Code issue involved pre-approved Hugging Face access.
Scope and defensive implications
Novee announced on July 28 that its researchers had been selected to present four sessions at Black Hat USA 2026 and DEF CON 34, including research involving agents from Anthropic, Google, and OpenAI. Novee CEO and co-founder Ido Geffen said the sessions examined failures occurring before expected safeguards take effect or within trusted components.
The retrieved reporting does not establish whether every reported issue has been remediated, nor does it provide vendor responses or CVE identifiers. Teams using coding agents in CI/CD should therefore distinguish between a model's prompt-handling behavior and the privileges granted to the surrounding workflow. In comparable agentic systems, untrusted issue text combined with broad tokens, shell access, and write-capable automation creates a high-consequence trust boundary. Least-privilege credentials, isolation of untrusted inputs, and review gates for workflow or package-publishing changes are common controls for reducing that class of exposure.
Key Points
- 1Novee reported that untrusted GitHub content could reach coding agents with execution and repository privileges, turning prompt injection into an infrastructure risk.
- 2The reported Claude Code path combined hidden issue instructions with Git behavior and GitHub Actions access, exposing potentially high-value tokens.
- 3Comparable agentic CI/CD deployments require separate controls for untrusted text, shell execution, credential scope, and write-capable repository automation.
Scoring Rationale
The reported attack paths affect prominent coding-agent workflows and describe remote code execution, credential theft, and software supply-chain consequences. The evidence available here does not establish remediation status or the prevalence of vulnerable deployments, but the issue is highly relevant to teams granting agents CI/CD credentials and shell access.
Sources
Public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
