At Black Hat USA on August 5, researchers from Novee Security showed that a single GitHub issue — opened by an outside account with zero write access to the repository — was enough to reach remote code execution against three different AI coding agents running in CI: Anthropic's Claude Code, Google's Gemini CLI, and OpenAI's Codex. All three vendors had already shipped fixes before the findings went public, which is the good news and the reason this is a checklist rather than an emergency. The bad news is that 'a patch exists' and 'my pipeline is running it' are two different facts, and the gap between them is exactly what a prompt-injection payload sitting in a public issue is built to exploit. [Full findings, vendor by vendor.](#/article/black-hat-2026-github-issue-claude-code-gemini-cli-codex-rce)
Which of the three do you actually run?
Match your CI setup to its fix
Version numbers only close the vendors' own patched entry points. The pattern underneath all three — an agent treating something inside the repository it's working on as an instruction rather than as data — is a configuration problem you carry, not one a version bump resolves for you.
Audit your own CI, not just the vendor changelog
- Search your CI configs for claude-code, gemini-cli / run-gemini-cli, and codex.
- Check the action tag, the package version, or the container image digest — not the version you last remember installing.
- Claude Code 2.1.163+, Gemini CLI 0.39.1+ / run-gemini-cli 0.1.22+. Codex has no version gate — its fix is the workspace-isolation change.
- The Claude Code chain specifically exploited a crafted git flag reaching a shell command unvalidated. Look for any step that interpolates issue or PR content directly into a bash invocation.
- Open a throwaway issue with an obviously adversarial title or body and confirm the agent handles it as inert text, not as an instruction.
Running the five steps once closes the vendors' disclosed gap. The ways this audit quietly fails anyway are the same four every time.
Four ways this audit gets called done when it isn't
Two DEF CON follow-on talks — Aug 7 and Aug 9 — may add detail beyond what Black Hat covered, and any of the three vendors could revise guidance as a result. Treat this as a snapshot: re-check version numbers against each vendor's own advisory page before signing off an audit, not against this guide months from now.
- One GitHub issue could hijack Claude Code, Gemini CLI, or Codex in CI, Black Hat researchers showed.
- All three vendors shipped fixes before the findings went public — confirm you're actually on them.
- Fixed releases: Claude Code 2.1.163+, Gemini CLI 0.39.1+ / run-gemini-cli 0.1.22+, Codex's fix is a workflow change.
- Check whether any workflow feeds raw issue or pull-request text straight into a command line.
- Caveat: GitHub's own advisory ties CVE-2026-54316 to only one stage of the chain, not the whole exploit.