5 min read
Vulnerabilities Novee Security disclosed CVE-2026-54316 at Black Hat USA 2026: a zero-privilege GitHub issue can reach CI runner secrets across Claude Code, Gemini CLI, and OpenAI Codex. The Claude Code variant eventually exfiltrated secrets one character at a time via Hugging Face download counters. A separate Gemini CLI flaw scored CVSS 10.0.