Novee Discloses Flaws in Major Coding Agents
Novee detailed GitHub-workflow vulnerabilities affecting Anthropic Claude Code, Google Gemini CLI and OpenAI Codex at Black Hat USA on August 5. The reported paths could turn untrusted issue text into code execution, credential theft or persistent instructions; Anthropic and Google patched the cited versions, while OpenAI changed its own issue-deduplication workflow within three days.
Novee researchers detailed security weaknesses in official GitHub workflows using Anthropic Claude Code, Google Gemini CLI and OpenAI Codex at Black Hat USA on August 5. The common problem was not simply a model responding badly to a prompt. Untrusted issue or pull-request text could reach an agent surrounded by shell tools, writable workspaces and repository credentials.
Novee's August 6 technical disclosure describes how these trust handoffs could lead to command execution, secret exposure, persistence and policy bypass. Google's security advisory and the National Vulnerability Database record independently confirm the cited Gemini CLI and Claude Code version and remediation details.
Claude Code: issue text reached privileged execution
In the first reported Claude Code route, hidden instructions in a public GitHub issue induced the agent to run a prepared git push command. The command reportedly passed Anthropic's validation but abused Git's receive-pack option to execute code on a GitHub Actions runner. That runner could expose GitHub and Anthropic API tokens and, depending on token permissions, allow workflow or package changes.
The NVD record for CVE-2026-54316 documents a separate Claude Code issue that abused pre-approved Hugging Face access to encode stolen data in requests to an attacker-controlled repository. The record says versions 0.2.54 through 2.1.162 were affected and version 2.1.163 contains the fix.
Gemini CLI: a restricted tool still exposed the shell
The Gemini CLI workflow appeared to allow only echo and a command for viewing GitHub issues. Novee found that the full shell tool was registered without enforcing that command-specific restriction at execution time.
Although sensitive variables were removed from child processes, commands running under the same user and process namespace could read the parent process environment through Linux /proc. The reported exposure included GitHub and Gemini API credentials. Google's advisory rates the issue critical at CVSS 10.0 and lists fixes in Gemini CLI 0.39.1, preview 0.40.0-preview.3 and run-gemini-cli GitHub Action 0.1.22.
Codex: instructions persisted between agent runs
OpenAI's issue-deduplication workflow ran two agents in the same writable workspace. Novee found that the first stage could be manipulated into writing an AGENTS.md file, which the second Codex run then treated as trusted project instructions even though the workflow rejected the first agent's direct output.
Novee reports that OpenAI corrected its repository within three days by separating the runs into different jobs and checkouts and later making the environments read-only. OpenAI said the Codex sandbox itself operated as documented. Those repository changes do not automatically repair similar third-party workflows.
The practical boundary is the workflow around the model: public text should not share a trust path with broad tokens, shell execution or writable state that survives into a later agent. Teams should update the affected tools, isolate agent stages, use least-privilege credentials and require review before workflows or packages can be changed.
Key Points
- 1Novee reported trust-handoff failures that let untrusted GitHub content reach coding agents with shell, token or writable-workspace authority.
- 2Anthropic and Google patched the cited Claude Code and Gemini CLI versions; OpenAI separated its Codex workflow stages and made their environments read-only.
- 3The shared defensive lesson is to isolate agent stages, restrict credentials and prevent public issue text from persisting into privileged execution contexts.
Scoring Rationale
The disclosed paths affect prominent coding-agent workflows and connect untrusted repository text to code execution, credential exposure and persistent instructions. Vendor fixes reduce immediate risk in the cited implementations, but comparable custom workflows still require review.
Sources
Primary source and supporting public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
