GitHub Issue Exploited Claude Code, Gemini CLI, Codex CI
SkimNews Take
Three rival AI coding tools from Anthropic, Google, and OpenAI converging on the same GitHub-issue-to-CI exploit suggests identical assumptions about issue-body safety got independently replicated — a sign the tooling category shipped faster than its threat model was updated.
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Novee Security showed that a GitHub issue opened by an account with no repository privileges was enough to execute code on CI runners behind Anthropic's and Google's coding-agent repositories, and hijack the next agent run on OpenAI's — work presented at Black Hat USA on August 5 that produced two CVEs, both now patched.
- Gemini CLI carried the worst of the two: CVE-2026-12537, an OS command injection in the container launcher with a CVSS 4.0 score of 10.0, reachable through a crafted .gemini/.env file that runs code on the host before the sandbox starts; fixed in Gemini CLI 0.39.1 and run-gemini-cli 0.1.22.
- Claude Code's CVE-2026-54316 turned Hugging Face's public download counter into an exfiltration channel that leaked an API key one character at a time, affecting every release from 0.2.54 through 2.1.163; patched in 2.1.163, with Anthropic rating the flaw Moderate at CVSS v4 6.0 while NVD gave CVSS v3.1 a 9.1.
- OpenAI's Codex received no CVE and no product fix — Novee reports OpenAI's position is that the sandbox behaved exactly as documented; OpenAI instead separated its two Codex passes into different jobs, added a read-only sandbox, and updated guidance to list repository instruction files among content that "should be considered part of the untrusted input surface."
- The harness — the code between the model and the real world that decides what actually runs — was the recurring failure point across all three tools, not the models themselves, per Novee founding engineer Elad Meged: one part marked a value safe, and a later part acted on that value with more authority.
- CISA lists exploitation as "none" on both CVE records and neither appears in the agency's Known Exploited Vulnerabilities catalog as of August 7, though a public GitHub repository describing itself as a reproduction lab for the Claude Code flaw has been live since June 18.
- Separately, Pillar Security reported on August 4 that the ChainDrop npm worm planted a Claude Code SessionStart hook and a VS Code folderOpen task in compromised repositories, firing when a developer opened the workspace rather than waiting for an install.
Why it matters: All three major AI coding agents — Claude Code, Gemini CLI, and Codex — were reachable via a routine GitHub issue to their own CI workflows, with Gemini CLI scoring a CVSS 4.0 of 10.0 and every Claude Code release from 0.2.54 onward affected. CISA lists no exploitation and a public reproduction lab has been live since June 18, but OpenAI declined to patch or issue a CVE, leaving the fix to workflow changes — a split response that puts the burden on the developer to know which vendor's "agent layer" they can trust.
Ask SkimNews
