Claude Code, Gemini CLI Flaws Let a GitHub Issue Run Code
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Novee Security ran the attack against Anthropic's, Google's, and OpenAI's coding agents in each vendor's default configuration and presented the findings at Black Hat USA on August 5, producing two CVEs.
- Gemini CLI carried CVE-2026-12537, an OS command injection scoring CVSS 4: 10.0 that is reachable via a crafted .gemini/.env file, fixed in Gemini CLI 0.39.1 and run-gemini-cli 0.1.22.
- Claude Code had CVE-2026-54316, which turned Hugging Face's public download counter into an exfiltration channel leaking an API key one character at a time, fixed in version 2.1.163 and affecting every release from 0.2.54 onward.
- OpenAI's Codex finding produced no CVE and no product patch — Novee reports OpenAI's position is that the sandbox behaved as documented, though OpenAI has since separated the two Codex passes and treats repository instruction files as untrusted input.
- CISA rates exploitation as "none" on both CVEs and neither appears in the Known Exploited Vulnerabilities catalog as of August 7, though a public GitHub reproduction repository for the Claude Code flaw has been live since June 18.
- Novee founding engineer Elad Meged identified the recurring failure as sitting in the harness code around each model — not in the model itself — where one part marks a value safe and a later part acts on it with more authority.
Why it matters: The same harness-level vulnerability class — one part marks a value safe, a later part acts on it with more authority — existed across Claude Code, Gemini CLI, and Codex. Gemini CLI scored CVSS 4: 10.0. Anthropic and Google shipped patches; OpenAI shipped only workflow and documentation changes. Every team running these tools in CI has specific version targets to install.
