By A GitHub issue — opened by an account with zero repository access — was enough to pull CI runner secrets out of the official repositories of Anthropic, Google, and OpenAI, with each company’s own AI coding agent doing the work. Security researcher Elad Meged of Novee Security demonstrated this at Black Hat USA 2026. Three CVEs, three vendors, one class of mistake: the code wrapped around each AI model trusted the wrong thing at the wrong time.
The part most developers will miss: the model itself behaved correctly. Claude, Gemini, and Codex were not jailbroken. Their harnesses — the scaffolding that decides what tools the model can run and which values are safe to pass through — had gaps that let an attacker-controlled string reach the real execution environment. This is a useful reframe. The question is no longer “is the model safe?” It is “is the harness safe?” Most teams have not asked that question yet.
Gemini CLI: A Perfect CVSS 10.0
The most severe finding targets Gemini CLI. CVE-2026-12537 scored a 10.0 under CVSS v4 — a perfect score — and the attack vector is blunt: submit a pull request containing a malicious .gemini/.env file. Earlier versions of Gemini CLI automatically trusted workspace folders in headless CI mode, which means the malicious configuration loaded as legitimate before any sandbox protections started. The attacker’s code ran on the host, not inside a container.
A separate path used prompt injection via GitHub issue: an attacker opens a public issue against a repo running Gemini’s auto-triage workflow, hides redirect instructions in the issue body, and the agent follows them. Independent research across 5,629 test executions found Gemini CLI was exploitable in 95.5% of runs, while the agent correctly identified a problem in only 1.99%.
The fix is Gemini CLI 0.39.1 and run-gemini-cli Action 0.1.22. If you are running any earlier version in CI, patch before finishing this article.
Claude Code: When the Allowlist Becomes the Attack
Anthropic’s Claude Code GitHub Action carries three CVEs across a patch-and-bypass sequence. The most inventive is CVE-2026-54316. Claude Code’s command validator strips single-quoted text before running its security checks — correct bash behavior — but a payload hidden inside the value of a git push --receive-pack flag passed through the validator and ran on the host. Two patches followed; Meged bypassed each one.
The final variant is the one worth understanding. Hugging Face was on Claude Code’s pre-approved service allowlist. Via prompt injection in a GitHub issue, an attacker instructs Claude to create up to 64 model repositories on Hugging Face — one per possible character in a target API key. For each character, Claude makes a model request to the matching repo, incrementing its public download counter by one. The attacker reads the counters. No secret leaves the CI environment directly. Public metrics do the leaking. This technique is now called an exfiltration oracle.
Every Claude Code release from 0.2.54 to 2.1.163 was affected — roughly two years of production releases. The patch is Claude Code 2.1.163 and claude-code-action v1.0.94. The action update also adds a human-actor validation check that the previous version skipped for anything ending in [bot], scrubs environment variables from child processes, and disables the workflow run summary that was itself a usable exfiltration channel.
OpenAI Codex: The Architecture Was the Bug
Codex ran two review passes inside a single GitHub Actions job using a shared checkout directory. AGENTS.md is the file Codex reads for operational instructions at the start of each pass. Pass one — controlled via prompt injection — writes a malicious AGENTS.md. Pass two reads it and executes the attacker’s instructions with full job permissions. OpenAI addressed this structurally rather than with a CVE: the two passes now run as separate jobs with separate checkouts, Codex operates in a read-only sandbox with drop-sudo, and AGENTS.md in automated workflows is formally documented as an untrusted input surface.
What to Do
The version updates are mechanical. The harder shift is architectural.
- Update Claude Code to 2.1.163 and claude-code-action to v1.0.94
- Update Gemini CLI to 0.39.1 and run-gemini-cli to 0.1.22
- Audit every workflow a user without write access — or a bot — can trigger
- Give agents only the secrets needed for each specific task; remove all others
- Never run multi-pass agent jobs in a shared checkout; use separate jobs with separate checkouts
- Treat
AGENTS.md, issue bodies, PR descriptions, and any user-controlled text as untrusted input - Review your service allowlists: every approved domain is a potential exfiltration channel if the agent can be instructed what to send to it
The Hugging Face covert channel is the finding worth internalizing most. Meged did not bypass the allowlist. He used it. A sanctioned service became the attack. That means restricting which services an agent can reach is necessary but not sufficient — what the agent is permitted to send to each service matters equally. The Cloud Security Alliance’s full analysis includes workflow audit templates for each agent.
Anthropic’s own system card for Claude Code had noted the GitHub Action was “not hardened against prompt injection” before any of this research. That warning now has a concrete exploit chain attached to it, including a covert channel through a publicly visible metric. Other vendors running AI agents in CI should assume their own system cards contain similar abstract warnings — with exploits waiting to be written.
