One GitHub issue, RCE on Claude Code and Gemini CLI runners

A single GitHub issue, filed by an account with no write access to the repository, was enough to execute attacker-controlled code on the CI runners behind Anthropic's, Google's and OpenAI's own coding-agent projects. Novee Security walked through the full chain at Black Hat USA on August 5. Two CVEs came out of it: Gemini CLI's is rated CVSS 10.0, and Claude Code's sits at 9.1 on NVD.

Three different agents, three different codebases, and all three failed at the same kind of seam. None of it required a misconfiguration. Every finding reproduced against vendor defaults, running on the vendors' own repositories.

RelatedContain the Goal, Not the Capability: Agents After Hugging Face

How does a GitHub issue reach a CI runner?

Agent workflows are wired to react to repository events. Someone opens an issue or comments on a pull request, a workflow fires, and the agent reads that text as its instructions. The text is untrusted by definition. Anyone with a GitHub account can write it.

Every vendor knew that, which is why each agent ships a harness: a validation layer between the command the model asks for and the shell that runs it. Anthropic's carries twenty-three separate checks in bashSecurity.ts, covering command-injection detection, shell metacharacters, and Unicode and encoding guards. The research did not defeat any model. It defeated the harness.

What exactly broke in Claude Code?

The first bypass is almost boring, which is what makes it good. Claude Code's preprocessor strips quoted content before the validators inspect a command, on the assumption that a quoted string is inert data. Git disagrees. Put the payload in a flag value, as in git push --receive-pack='sh -c "..."', and the validator sees a stripped, harmless-looking push while git hands the flag value straight to a shell.

Anthropic patched it. The researchers came back with a second route: a hardcoded list of commands the binary classifies as read-only, including tac, rev, fold, expand and unexpand. Those skip path validation entirely, so tac /etc/hosts reads a file that cat would have been blocked from touching. A third variant used empty quotes to slip past the guard watching for the literal string "environ", turning rev /proc/self/enviro""n into an environment dump.

Reading a secret is only half an exploit. Getting it out took an oracle. The researchers registered a Hugging Face repository for each possible character, then had the agent fetch a file from whichever repo matched the next character of the API key. The public download counter revealed which one. One character per request, exfiltrated through a public GitHub Actions log. That chain became CVE-2026-54316 after three rounds of patch and bypass, and three separate bounty awards.

Why did Gemini CLI score a perfect 10?

CVE-2026-12537 is an OS command injection in Gemini CLI's container launcher, reached through a crafted .gemini/.env file. The timing earns the score. The injection lands on the CI host before the sandbox starts, so the isolation meant to contain the agent never gets a chance to exist.

Two smaller findings explain how a payload gets that far. Gemini CLI's tool registration checks whether a tool name begins with run_shell_command(, and if it does, registers the full unrestricted shell tool. The annotation inside the parentheses, the part meant to pin the tool to one specific command, is never parsed, stored or enforced at runtime. Separately, the child process environment is sanitized but the parent's is not, and because child and parent share a UID and a PID namespace, /proc/$PPID/environ stays readable.

Google's advisory is GHSA-wpqr-6v78-jr5g. The affected package pulls roughly two million installs a month, which is the number that turns a clever bug into an ecosystem problem.

And Codex?

OpenAI's finding got no CVE, because it is not a defect in a binary. It is a workflow shape. Codex pipelines often run several passes over one shared workspace. Pass one handles the untrusted input, holds write access, and drops an AGENTS.md into the repo. A validation step then fails, which is part of the attack rather than an accident, and pass two starts fresh and loads that file as its authoritative standing instructions. OpenAI's protected-path list covered .git/, .agents/ and .codex/, but not the default instruction file the agent actually reads on startup.

RelatedSimpleHelp Auth-Bypass Flaw Threatens MSPs at CVSS 10

Who is actually exposed?

Anyone running one of these agents in a workflow that an external user can trigger. The supply-chain version is the part worth sitting with. One issue fires a workflow holding contents:write. The attacker reads GITHUB_TOKEN out of the environment, dispatches a second workflow, and pushes a backdoor to main. Everything downstream then installs it through the normal, trusted channel.

As of August 7, CISA lists neither CVE in the Known Exploited Vulnerabilities catalog, so there is no evidence of exploitation in the wild yet. A public reproduction lab for the Claude Code flaw went up on GitHub back on June 18, which narrows the gap between disclosure and weaponisation considerably.

1. Jun 18Public reproduction lab for the Claude Code bypass appears on GitHub before any of it was presented
2. Aug 5Novee Security presents the full chain at Black Hat USA patches already shipped
3. Aug 7Neither CVE appears in CISA KEV no known exploitation
4. NextCopycat research against smaller agent harnesses the pattern generalises

What did the vendors actually change?

Anthropic replaced wildcard matching with an explicit git-push allowlist, removed arbitrary Bash tools, disabled the display_report output channel that carried the exfiltration, and scoped the Hugging Face domain down to documentation paths. Anthropic's framing is that exploitation still required getting untrusted content into a Claude Code context in the first place, which is fair, and also exactly what an issue-triggered workflow does by design.

Google went further than a patch. Alongside fixing allowlist enforcement and the container launcher, it shipped a breaking change to how non-interactive headless environments handle folder trust, and split CI job runs apart. OpenAI updated its guidance to list repository instruction files as part of the untrusted input surface and now recommends running Codex as the final step in a pipeline, in a read-only sandbox.

Our take

The headline number will be the CVSS 10.0, and it deserves it. The more useful finding is the one Novee put at the end: all three attacks are trust-handoff failures. Validation was correct at one boundary and the assumptions behind it were wrong at the next. That is a category, and the category is not specific to these three vendors. Every agent shipping today has a harness doing roughly this job, most of them with less scrutiny than the three that just got taken apart on stage.

If you run any coding agent in CI, the practical order is: update to the fixed versions, then go read which of your workflows an outsider can trigger, then check what token those workflows hold. The second and third steps matter more than the first, because they are the ones that still protect you against the bug nobody has found yet.

Original analysis by GenZTech, built from the Novee Security research presented at Black Hat USA on August 5, 2026, vendor advisories, and the CISA KEV catalog as of August 7.