AI Coding Agents’ RCE Flaw: One GitHub Issue Did It

Security researcher Elad Meged of Novee Security demonstrated at Black Hat USA 2026 that a single GitHub issue can trigger remote code execution and exfiltration of API keys and tokens from AI coding agents, affecting Claude Code, Gemini CLI, and OpenAI Codex. The vulnerabilities include CVE-2026-54316 in Claude Code (fixed in 2.1.163) and CVE-2026-12537 in Gemini CLI (CVSS v4 score 10.0, fixed in 0.39.1 and run-gemini-cli 0.1.22), while OpenAI declined to issue a CVE for Codex, stating the sandbox behaved as documented.

A stranger opens a GitHub issue on your public repo. No permissions, no fork, no special access — just a text field and a submit button. Your AI coding agent reads the issue as part of a routine CI workflow, and within seconds, your ANTHROPIC API KEY and GITHUB TOKEN are in someone else’s hands. This is not a thought experiment. Novee Security’s Elad Meged demonstrated it live at Black Hat USA 2026, and it hit Claude Code, Gemini CLI, and OpenAI Codex in one sweep. One GitHub Issue, Three Victims The attack starts with something any user can do: open a GitHub issue. Meged crafted an issue body containing a prompt-injection payload that rode through the AI agent’s issue-processing workflow into the CI runner. The runner held everything — workflow secrets, API tokens, push access. The agent delivered them faithfully because it was designed to be helpful, and nobody told the harness to stop trusting public input. In Claude Code’s case, the attack exploited Action tag mode. A valid-looking git push command carried a Git flag with a quoted value that command validators read as benign but Git itself later executed. That execution reached the runner environment, where GITHUB TOKEN and ANTHROPIC API KEY were sitting in plain environment variables. The credentials were then exfiltrated using Hugging Face’s public model download counter as a covert channel — leaking the API key one character at a time in what looked like routine model traffic. This is CVE-2026-54316, fixed in Claude Code 2.1.163 . Gemini CLI Scored a Perfect 10 The most technically alarming finding is CVE-2026-12537 in Gemini CLI, which received a perfect CVSS v4 score of 10.0 https://github.com/advisories/GHSA-jj69-4grx-fqj5 . In headless CI mode, Gemini CLI automatically trusted any workspace directory and loaded .gemini/.env configuration files without requiring explicit authorization — and it did this before the sandbox started. An attacker with write access to the repo could plant a crafted .env file that injected OS commands at startup, before any security layer had a chance to intercept them. The fix required a fundamental change: upgraded versions now demand explicit workspace authorization before reading any configuration. The patched versions are Gemini CLI 0.39.1 and run-gemini-cli 0.1.22. If your CI pipeline uses either and has not updated, it is currently exploitable. OpenAI Said the Sandbox Worked as Intended Codex was part of the same attack chain, but OpenAI’s response was jarring: no CVE, no patch version, no acknowledgment of a bug. Their official position is that the sandbox “behaved exactly as documented.” The security research community was not impressed. When documented behavior includes exfiltrating CI secrets through a public GitHub issue, the documentation is the problem. There is a difference between intended behavior and acceptable behavior, and vendors conflating the two to avoid a patch cycle erodes developer trust. The Model Is Not the Problem Here is what gets missed when this is framed as an “AI security” story: the models did nothing wrong. Claude, Gemini, and GPT-4o processed inputs and produced outputs consistent with their training. The vulnerability was in the harness — the surrounding infrastructure managing tool permissions, execution context, file system access, trust levels, and sandbox boundaries. The harness is what most teams write themselves, in GitHub Actions YAML files and shell scripts, without a security review. Check Point Research raised the same structural issue in February 2026, when they disclosed CVE-2025-59536 and CVE-2026-21852 https://research.checkpoint.com/2026/rce-and-api-token-exfiltration-through-claude-code-project-files-cve-2025-59536/ — both exploiting Claude Code’s project configuration files hooks, MCP server configs, ANTHROPIC BASE URL redirect . The pattern is consistent across six months of disclosures: developers are giving AI agents access to production secrets inside configuration files that anyone submitting a pull request can influence. What to Do Right Now The patch versions are not optional: Claude Code: Update to 2.1.163 or later Gemini CLI: Update to 0.39.1 or later run-gemini-cli GitHub Action: Pin to 0.1.22 or later Codex: No patch available — audit your workflow manually Beyond patching, the GitHub Agentic Workflow security architecture guide https://github.blog/ai-and-ml/generative-ai/under-the-hood-security-architecture-of-github-agentic-workflows/ lays out the right model: agents isolated in dedicated containers, credentials routed through trusted proxies outside agent boundaries, logging at every trust boundary. The core rule is simple — treat AI coding agents as untrusted contributors, not automated maintainers with implicit trust. Never let a public issue be the sole trigger for code that runs with repository secrets. Separate agents that read from agents that write. Minimize token scope to exactly what each task requires. The industry moved fast building these workflows. The security thinking is catching up. The developers maintaining AI-powered CI/CD pipelines need to treat the harness as security-critical infrastructure — because someone who only has a GitHub account and five minutes already knows it is https://thehackernews.com/2026/08/claude-code-and-gemini-cli-flaws-let.html .