Unprivileged GitHub Issue Can Compromise Claude Code and Gemini CLI CI Runners

Research by Novee Security showed that an unprivileged user can exploit a GitHub issue to execute code on the CI runners used by Anthropic and Google repositories. The technique can also alter agent execution flows in OpenAI workflows.

The tests focused on the vendors’ default configurations. The research was presented at Black Hat USA on August 5, 2026; the findings became public on August 7, 2026.

CISA records list exploitation: none for both CVEs. There is no evidence of attacks against real-world targets.

The Common Problem Lies in the Agent Harness

The flaw affects the “harness”—the code that connects the model to the operating system, tools, and CI workflows. One component treats a value as trusted, while a subsequent component interprets it with elevated privileges.

As a result, user-controlled content can bypass validation and reach a privileged execution point. The attack does not necessarily require convincing the model to run a command: in some cases, the payload is processed directly by the infrastructure.

The risk increases in repositories where issues can trigger workflows, agents have checkout access, and later steps reuse files modified by the agent.

Gemini CLI: Command Injection Before Sandboxing

Google fixed CVE-2026-12537, a command injection vulnerability in the Gemini CLI container launcher. The issue has a CVSS v4 score of 10.0.

An unprivileged attacker could prepare a .gemini/.env file and execute commands on the host system of a headless CI platform before the sandbox was started. No model manipulation was required.

The vulnerability also affected tool allowlist handling. Checks were performed during registration but were not correctly enforced at execution time. With the --yolo option, every command requested by the model was also approved automatically.

The fixed versions are:

• Gemini CLI 0.39.1
• run-gemini-cli 0.1.22

Google included both the launcher and allowlist fixes in the same advisory, stating that the changes affect all Gemini CLI GitHub Actions.

Claude Code: API Key Exfiltration and Bypassable Validator

Anthropic fixed CVE-2026-54316, a vulnerability that allowed an API key to be exfiltrated through Hugging Face’s public download counter. The secret could be transmitted one character at a time.

The prerequisite was the presence of untrusted content in Claude Code’s context. Anthropic assigned the flaw a CVSS v4 score of 6.0, rated Moderate, while NVD lists a CVSS v3.1 score of 9.1. The scores use different CVSS versions and are not directly comparable.

The fixed version is Claude Code 2.1.163. Releases from 0.2.54 through 2.1.163 are listed as affected.

A second attack chain was not assigned a CVE, and no publicly specified fixed version was provided. The command validator removed text enclosed in single quotes before running 23 checks. This behavior is normally correct for Bash, but it allowed an attacker to hide a payload in the --receive-pack option value of git push.

Git then executed the parameter while leaving the payload unchanged on the runner. The validation therefore passed, while the final command could execute code.

Codex: The Risk Comes from Checkout Sharing

In the openai/codex repository, two agent steps ran in the same job and shared the same checkout. The first could modify AGENTS.md, which the second loaded as an instruction set.

In addition, a JSON validation failure between the two steps could still trigger the second agent. A file written by a less trusted step could therefore influence subsequent execution.

The current configuration separates the steps into distinct jobs, runs Codex with drop-sudo, and uses a read-only sandbox. OpenAI documentation treats repository instruction files as untrusted input and recommends running Codex as the final job step.

There is no evidence that Codex handles a writable instruction file differently. The documented mitigation concerns workflow design and step isolation.

How to Reduce Risk in CI Workflows

Administrators should:

• update Gemini CLI to 0.39.1;
• update run-gemini-cli to 0.1.22;
• update Claude Code to 2.1.163;
• review workflows that can be triggered by issues or external users;
• treat AGENTS.md, .gemini/.env, and all other repository files as untrusted input;
• separate agents into distinct jobs;
• use read-only sandboxes and drop-sudo where available;
• run the agent as the final job step.

It is also advisable to inspect repositories for unexpected changes to instruction files, workflows, and agent configurations. A public lab for reproducing the Claude Code flaw has been available since June 18, but there is no evidence of operational exploitation of the attack chains described.