Black Hat 2026: Zero-Privilege GitHub Issue Hit AI Coding Agent CI Pipelines

Novee Security researcher Elad Meged presented research at Black Hat USA on August 5 that landed hard in a crowded vulnerability week. The finding: a single GitHub issue, opened by an account with zero repository privileges, was enough to reach CI runner secrets in the official repositories of Anthropic’s Claude Code, Google’s Gemini CLI, and OpenAI’s Codex. Each vendor was running in its default, shipped configuration.

The core class of vulnerability is not new. AI coding agents that integrate with GitHub Actions create trust relationships with CI infrastructure, and those trust relationships have proven easier to abuse than vendors anticipated. What makes Novee’s Black Hat disclosure stand out is the patch-and-bypass sequence on Claude Code, which ended with a covert exfiltration technique that will be studied in security circles for a while.

The Claude Code Attack Chain

CVE-2026-54316 starts with a validator problem. Claude Code’s command validator was designed to block untrusted inputs from reaching CI runners. Before running its 23 security checks, the validator strips single-quoted text from the input. That preprocessing step is the problem.

A payload placed in the value of a git push --receive-pack flag, a flag that git executes rather than passing through as a simple argument, bypassed the strip-and-check sequence and reached the runner untouched. Secrets in the CI environment were accessible from that point.

Anthropic patched. Novee bypassed. Anthropic patched again. Novee bypassed again. The third iteration of the attack abandoned direct secrets access entirely and took a different route.

Claude Code ships with pre-approved network access to Hugging Face for model downloads. That access is legitimate and expected. The third attack variant exploited it as a covert channel. The target secret was an API key. Rather than exfiltrating it with a direct HTTP call to an attacker-controlled server — which might trigger network alerts — the attack encoded the key one character at a time. Each character was transmitted by making an HTTP request to Hugging Face that incremented a specific model’s public download counter. An attacker watching those counters from outside the network could read the counter values and reconstruct the secret.

There was no outbound connection to suspicious infrastructure. The traffic was indistinguishable from normal Hugging Face model interaction. Standard CI network monitoring would not have caught it.

Affected versions run from Claude Code 0.2.54 up to 2.1.163. The fix is in 2.1.163. Anthropic’s own CVSS v4 rating is 6.0 (Moderate). The National Vulnerability Database’s independent CVSS v3.1 score is 9.1 (Critical). That gap reflects genuine disagreement about exploitability — but the covert channel technique argues for taking the higher score seriously.

The Gemini CLI CVSS 10 Flaw

Separately, Novee disclosed CVE-2026-12537 affecting Gemini CLI. This is a less exotic but more severe flaw: an OS command injection vulnerability in Gemini CLI’s container launcher that allows direct remote code execution on the host. It received a CVSS score of 10.0.

The vulnerability is fixed in Gemini CLI 0.39.1 and run-gemini-cli 0.1.22. Any team running Gemini CLI in CI or automated workflows should treat this as a priority update — CVSS 10 means there is no authentication barrier and no precondition for exploitation.

The Structural Problem These Findings Expose

Novee’s Black Hat research joins a pattern that has been building across 2026. AI coding agents are being integrated into CI/CD pipelines at speed, and the security assumptions baked into that integration are not holding.

The trust model is the core issue. When an AI coding agent has pre-approved access to services — Hugging Face, npm, GitHub APIs — that access exists because it is needed for the agent’s legitimate functions. But pre-approved access is also a capability set that an attacker, having found a way to influence the agent’s actions, can put to their own use. The Hugging Face download counter attack is a demonstration of that: the attacker did not steal Claude Code’s Hugging Face credentials. They leveraged Claude Code’s legitimate Hugging Face access to encode and transmit data the agent was never supposed to touch.

This pattern — using trusted agent capabilities as an exfiltration or lateral movement vehicle — is likely to produce more CVEs in the coming months. Cordyceps, disclosed by Novee in June, demonstrated the same structural pattern at scale across GitHub Actions. The Black Hat research demonstrates it applies within the AI coding agents themselves.

What to Do Now

Update Claude Code to 2.1.163. Update Gemini CLI to 0.39.1. If you are running run-gemini-cli, update to 0.1.22.

Audit which external services your AI coding agents have pre-approved access to. For each service, ask whether an attacker who could influence the agent’s actions could use that service access as an exfiltration channel. Outbound allowlists for CI runners should be strict. Agent access to external APIs should be the minimum necessary for the agent’s actual task.

The Novee research and vendor advisories are worth reading in full. The patch-and-bypass timeline in particular is instructive for security teams thinking about how to evaluate the depth of AI coding agent vulnerability patches.

References

• Novee Security — Critical Flaws in Anthropic, Google, and OpenAI’s Coding Agents
• The Hacker News — Claude Code and Gemini CLI Flaws Let a GitHub Issue Reach CI Workflow Secrets
• Novee Security — Google Gemini CLI CVSS 10.0 RCE Vulnerability Advisory
• Cloud Security Alliance — Three AI Coding Agents, One GitHub Issue: CI/CD Secrets Exposed
• SecurityWeek — Gemini CLI Vulnerability Could Have Led to Code Execution, Supply Chain Attack