Novee Security Finds Zero-Privilege Flaws in Claude Code, Gemini CLI, and Codex Around Black Hat USA 2026
Researcher Elad Meged showed a privilege-less GitHub issue could reach CI secrets in Claude Code, Gemini CLI, and Codex; two flaws got CVEs, one didn't.
Overview
A GitHub issue opened by an account with no repository privileges was enough to reach CI runner secrets in AI coding agents built by three of the industry’s largest vendors, according to research from Novee Security published around Black Hat USA 2026. Researcher Elad Meged, described on the company’s blog as Novee’s founding engineer and security researcher, found separate exploitable flaws in Anthropic’s Claude Code, Google’s Gemini CLI, and OpenAI’s Codex, all triggerable from untrusted content an outside attacker could post without ever needing write access to the target repository, according to The Hacker News and the Cloud Security Alliance.
What We Know
Claude Code. Anthropic’s coding agent is tracked as CVE-2026-54316, rated 9.1 (critical) under CVSS v3.1 and 6.0 under Anthropic’s own CVSS v4 scoring, according to the National Vulnerability Database. Versions 0.2.54 through 2.1.162 pre-approved huggingface.co as a destination for the tool’s WebFetch capability, which meant an attacker who could inject untrusted content into the agent’s context could make it issue requests against an attacker-controlled Hugging Face repository, opening a covert data-exfiltration channel, per the NVD record. According to SC World, the underlying scenario let an attacker “exploit hidden instructions within a GitHub issue to execute code on the GitHub Actions runner, potentially exposing API tokens and allowing repository modification.” The flaw was fixed in version 2.1.163, per NVD.
Gemini CLI. Google’s tool carries a separate identifier, CVE-2026-12537, described by NVD as “improper neutralization used in an OS command in the container launcher” that let an unprivileged attacker achieve host-level code execution before the sandbox even started, via a maliciously crafted .gemini/.env file, on versions of Gemini CLI before 0.39.1 and the run-gemini-cli GitHub Action before 0.1.22. NVD lists the CVSS v4 base score at 10.0, the maximum possible severity. Separately, according to SC World, the tool also allowed “access to sensitive credentials by reading the parent process’s environment,” and Cyberpress reported Meged explaining that “a compromised child process could access the parent process environment through Linux process interfaces, recovering credentials intended to be isolated.” Google fixed both issues in gemini-cli 0.39.1 (and 0.40.0-preview.3) and run-gemini-cli 0.1.22.
Codex. OpenAI’s agent was not assigned a CVE. According to GBHackers, “the first agent processed untrusted issue content with write access to a shared workspace,” and that pass “could generate AGENTS.md, an instruction file that the next Codex invocation would load” as trusted commands — a multi-pass workflow pattern independently described the same way by Cyberpress. Novee’s own account of the fix, posted on its blog, says: “3 Days after our report they fixed it and the two passes on openai/codex were split into separate jobs, each with its own checkout, which breaks the attack, because Pass 1 can no longer leave anything behind for Pass 2. Since then the checkout has been removed entirely, every Codex step runs drop-sudo in a read-only sandbox, and AGENTS.md in workflows is now documented as an untrusted input surface,” according to Novee Security.
Scope. Novee said the vulnerable patterns weren’t confined to the three vendors’ own repositories: the Cloud Security Alliance research note cites Novee’s finding of “well over a hundred public repositories” running configurations identical to the vulnerable vendor defaults, a figure SC World rendered as “over 100 public repositories.” The Cloud Security Alliance and The Hacker News both frame the common thread as what the Cloud Security Alliance describes as “the harness is the code between the model and the real world” — the glue code, permissions, and automation surrounding a model, rather than the model itself, that carried the exploitable gaps.
What We Don’t Know
None of the reviewed coverage specifies the exact day Novee presented the findings at Black Hat USA 2026, only that the disclosure and blog post followed the conference. It’s also not clear from available reporting how many organizations were running the vulnerable default configurations outside the sample of public repositories Novee examined, or whether any of the three flaws were exploited in the wild before the vendor fixes shipped.
Remediation
The Cloud Security Alliance note recommends organizations upgrade to the patched releases immediately, audit any workflow triggered by external contributors through issues, pull requests, or comments, rotate repository secrets and GITHUB_TOKEN credentials, and — specific to Codex — split multi-pass agent jobs into separate jobs with clean checkouts. GBHackers adds that organizations should isolate agent stages with separate workspaces and identities and enforce tool permissions at execution time rather than only at configuration time.