A GitHub Issue Could Compromise Your AI Coding Agent — Black Hat 2026 Research

Security researcher Elad Meged of Novee Security walked off a Black Hat USA stage on August 5 having shown live exploitation of critical vulnerabilities in Claude Code, Gemini CLI, and OpenAI Codex. The full writeup landed August 7.

The attack surface, in each case, was GitHub itself — a public issue, opened by someone with zero repository privileges, was enough to start an exploit chain.

The core problem

“The harness is the code between the model and the real world,” Meged said in the presentation, explaining why all three tools share a systemic weakness. AI coding agents accept instructions from external sources — issues, pull requests, comments — and then act on them inside environments that hold real secrets.

The researchers’ framing holds: one component labels attacker-influenced content as safe, while a subsequent component interprets it with greater authority. The validator passes, the exploit runs.

Claude Code: CVE-2026-54316

On Anthropic’s own claude-code repository, the researchers triggered remote code execution by exploiting a mismatch between Claude’s command validation logic and how the shell interprets quoted strings. A malicious git push flag bypassed the security check.

After Anthropic patched that, the team found a second bypass using tac to read arbitrary files, and then a third: using Hugging Face’s public download counter as a covert channel to leak an API key one character at a time. CVE-2026-54316 covers the data exfiltration path, with a CVSS v3.1 score of 9.1.

The fix is in Claude Code 2.1.163. Versions 0.2.54 through 2.1.162 are affected.

Gemini CLI: CVSS 10.0

Google’s Gemini CLI registered a full shell tool at startup with no runtime command restrictions. In “yolo mode” — Gemini CLI’s way of auto-approving tool calls — an injected instruction could execute arbitrary shell commands with no further user interaction.

Credential recovery went through /proc in the shared process namespace. From there, the researchers had a pathway to repository takeover and supply chain tampering. Google assigned this GHSA-wpqr-6v78-jr5g with a CVSS score of 10.0.

Update to Gemini CLI 0.39.1 or run-gemini-cli 0.1.22 to be safe.

Codex: instruction file persistence

OpenAI’s Codex issue-deduplication workflow ran two agents inside the same writable workspace. The researchers manipulated the first agent into writing a malicious AGENTS.md file. Codex automatically reads that file as trusted project instructions on its next run. The second agent followed attacker-written instructions without a sandbox escape requirement.

OpenAI addressed this through workflow separation and documentation rather than a product patch. No CVE was assigned.

What to do

If you run any of these tools in automated GitHub workflows, act now:

• Update Claude Code to 2.1.163 or later
• Update Gemini CLI to 0.39.1 or run-gemini-cli to 0.1.22
• Audit every workflow that a contributor without write access can trigger
• Isolate agent stages with separate workspaces and identities so one agent’s output cannot become a second agent’s trusted input
• Strip any tokens from the environment that a workflow step doesn’t actually need

The researchers’ full writeup and the Novee Security blog have the complete attack walkthroughs and proof-of-concept details.

Why this matters

This isn’t a fringe attack. Every team running AI code review, auto-triage, or CI-integrated coding agents against a public or semi-public repository is in scope. The attack doesn’t require exploiting a dependency or breaking cryptography — it just needs someone to open an issue with the right payload.

The lesson from the research is structural: AI agents that act on untrusted input need more than prompt-level guardrails. The agent’s output needs to be treated as untrusted too.

Sources: The Hacker News · GBHackers · SecurityWeek · Novee Security · cybersecuritynews.com