One GitHub issue, opened by an outsider with zero access, could hijack Claude Code, Gemini CLI, or Codex, researchers showed at Black Hat

At Black Hat USA on August 5, researchers from the AI-security firm Novee showed that a single GitHub issue — opened by an outside account with no write access to the repository — was enough to trigger remote code execution against three different vendors' AI coding agents: [Anthropic's](#/company/anthropic) Claude Code, [Google's](#/company/google) Gemini CLI, and [OpenAI's](#/company/openai) Codex. Presenter Elad Meged's talk, "Trusted Enough to Run: Breaking AI Agents in Official Workflows," argued the common failure wasn't in any of the underlying models — it was in the software wrapped around them: the permission logic, tool routing, sandboxing, and shared workspaces that decide what an agent is allowed to touch once it starts reading a repository's own issues and pull requests.

All three vendors had already patched by the time the findings went public — this is disclosed, fixed vulnerability research, not an ongoing exploit. Novee, founded by Ido Geffen, Gon Chalamish, and Omer Ninburg and backed by $51.5 million from investors including YL Ventures and Canaan Partners, framed the pattern across all three as a trust-handoff problem. "These sessions show that some of the most serious security failures emerge before expected safeguards take effect, or inside components organizations already trust," CEO Ido Geffen said in the company's pre-conference announcement.

How one GitHub issue reached three different vendors' runners

In Anthropic's case, the chain started with Claude Code Action, the GitHub Actions integration that lets the agent respond to issues and pull requests automatically. Claude Code's command validator strips single-quoted text before running its 23 built-in security checks — correct behavior for how bash actually parses quotes, but it meant a payload hidden inside the value of a git flag, specifically a crafted `git push --receive-pack` option, reached the runner without ever being inspected. A prompt-injection payload planted in a GitHub issue could steer the agent into constructing that command itself, achieving code execution on the Actions runner and exposing workflow secrets including the repository's `GITHUB_TOKEN` and its `ANTHROPIC_API_KEY`.

Anthropic shipped fixes as Novee kept finding follow-on bypasses: one used the Unix `tac` command to read files back out through GitHub Actions' own logs, and a third abused a pre-approved `huggingface.co` hostname inside Claude Code's WebFetch tool as a covert channel, leaking a stolen API key one character at a time through Hugging Face's public download counter. That last stage is the one documented in Anthropic's own GitHub security advisory, GHSA-fg94-h982-f3mm, published June 13 — five weeks before the Black Hat talk — rated 9.1 under NVD's CVSS v3.1 scoring, and fixed in Claude Code 2.1.163.

This is not Claude Code's only disclosed flaw this year. Anthropic's own GitHub advisory list already carried seven high- or moderate-severity security advisories for the tool before this one, going back to February — a git-worktree sandbox escape published in June, a trust-dialog bypass via a repo-controlled settings file in March, another via git-worktree spoofing in April. Several follow the same broad shape as the Black Hat finding: a guardrail meant to treat a repository's own contents as untrusted gets defeated by something inside that repository. Reading the advisory list as a set, rather than one disclosure at a time, is what shows that pattern; no single write-up states it.

Gemini CLI's maximum-severity rating

Google rated its own flaw the maximum possible CVSS 10.0. Novee's own writeup, published April 23 when the fix was still new, describes two compounding problems: Gemini CLI's automatic folder-trust behavior meant a pull request carrying a malicious `.gemini/` directory could reach remote code execution the moment a CI pipeline ran the tool against untrusted code, and a shell-command allowlist Google's own tooling marked "restricted" was never actually enforced at runtime. Google's fix — shipped as Gemini CLI 0.39.1 and run-gemini-cli 0.1.22 — was, in Novee's account, "a breaking change to its trust model for non-interactive execution environments": CI and other headless runs of Gemini CLI now require an explicit trust confirmation they didn't require before.

Codex's shared-workspace problem

OpenAI's Codex issue was structural rather than a single exploitable bug in a validator. The company's own openai/codex repository ran two Codex passes inside one CI job sharing a single checkout. The first pass could write to `AGENTS.md`, the instruction file the second pass loads and treats as trusted — so an attacker able to influence the first pass's output could plant instructions the second pass would then follow as its own. OpenAI didn't ship a version bump for it; it fixed its own workflow by separating the two passes into isolated jobs within three days of the finding, and now documents `AGENTS.md` as an untrusted input surface.

What CVE-2026-54316 actually covers

Coverage of the Claude Code finding converges on one CVE number, but not on what it covers — and that's worth being precise about, because the sources disagree with each other, not just with the framing on stage.

Whichever label applies to which stage, the practical fact is the same across all three vendors: a researcher, using nothing but the ability to open a public GitHub issue, could turn a coding agent's own automation against the repository it was supposed to help maintain. None of the three companies disputes that framing — each shipped a fix, and none has disclosed evidence that the techniques were used against a real target before Novee reported them.