Black Hat USA 2026: One GitHub Issue Could Compromise Major AI Coding Workflows

Summary

Researchers at Black Hat USA 2026 disclosed critical vulnerabilities in AI coding assistants from Anthropic (Claude Code), Google (Gemini CLI), and OpenAI (Codex). These flaws, exploitable via malicious GitHub issues, could lead to remote code execution, credential theft, and unauthorized repository modifications. The vulnerabilities affected specific versions of the tools and have since been patched.

Full text

Security Artificial IntelligenceBlack Hat USA 2026: One GitHub Issue Could Compromise Major AI Coding Workflows At Black Hat USA 2026, Novee found GitHub workflow flaws in Claude Code, Gemini CLI and Codex that enabled RCE, credential theft and agent control in pipelines. byWaqasAugust 6, 20263 minute read Listen to this article 0:00 — ← 10s ▶ Play 10s → Speed 0.75× 1× 1.25× 1.5× 2× Voice Loading voices… Press play to start listening A public GitHub issue opened by an outside user with no repository privileges could have turned AI coding tools from Anthropic, Google and OpenAI against the repositories they were meant to maintain, according to research presented by Novee Security at Black Hat USA 2026. Researchers tested Claude Code, Gemini CLI and Codex using the vendors’ own repositories and default workflow configurations. They found paths to remote code execution, credential theft, repository modification and instructions that persisted between separate agent runs. During these workflows, coding agents read GitHub issues or pull requests and perform tasks such as identifying duplicate reports, reviewing code or managing repositories. The danger appears when text supplied by an outsider reaches an agent with access to command-line tools, repository tokens, or other credentials. Claude Code Required Three Corrections With Claude Code, Novee first found that an attacker could place hidden instructions inside a GitHub issue and ask the agent to run a specially prepared git push command. The command passed Anthropic’s validation checks but abused Git’s receive-pack option to execute code on the GitHub Actions runner. That access could expose the workflow’s GitHub and Anthropic API tokens. Depending on the permissions assigned to the GitHub token, an attacker could also modify workflows or publish altered packages under the affected repository’s namespace. After Anthropic blocked that route, Novee found further methods involving unrestricted file reads and data theft. The final issue, tracked as CVE-2026-54316, abused Claude Code’s pre-approved access to Hugging Face. According to Novee Security’s report shared with Hackread.com, an attacker could instruct Claude to make requests to an attacker-controlled Hugging Face repository and encode stolen information into those requests. By monitoring download counts on repositories they controlled, an attacker could reconstruct the stolen information. The flaw affects Claude Code versions 0.2.54 through 2.1.162 and was fixed in version 2.1.163. Gemini CLI Flaw Receives Maximum CVSS Score Google’s case began with a tool restriction that appeared to permit only echo and a GitHub issue-viewing command. Novee found that Gemini CLI registered the full shell tool without enforcing the command-specific restriction during execution. Although sensitive variables were removed from child processes, those secrets remained inside the parent Gemini CLI process. Because both processes shared the same user and process namespace, commands could read the parent environment through Linux’s /proc filesystem and obtain the GitHub token, Gemini API key, and other credentials. Google rated the issue critical with a CVSS score of 10.0. The affected software includes Gemini CLI versions before 0.39.1, preview versions before 0.40.0-preview.3, and run-gemini-cli GitHub Action versions before 0.1.22. The impact is limited to headless workflows that process untrusted content under the affected settings. Codex Instructions Persisted Between Agent Runs OpenAI’s Codex issue-deduplication workflow ran two agents inside the same writable workspace. Novee found that the first agent could be manipulated into creating an AGENTS.md file, which Codex automatically reads as project instructions during its next run. When the second agent started, it accepted the attacker-written file as trusted instructions. This allowed influence from the first stage to persist even though the workflow checked and rejected its direct output. OpenAI corrected its repository within three days by separating the agent runs into different jobs and checkouts, then moving them into read-only environments. OpenAI said the Codex sandbox operated as documented. The company corrected its own repository, but those changes did not automatically fix similar workflows created by other organizations. Novee found comparable configurations in more than 100 public repositories. The report describes controlled proof-of-concept testing and does not report malicious exploitation. Companies using these tools should install the corrected Claude Code and Gemini CLI versions, review workflows triggered by public issues or pull requests, prevent separate agents from sharing writable directories, and limit tokens to the permissions required for each task. Waqas I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cybersecurity and tech world. I am also into gaming, reading and investigative journalism. View Posts AI ToolsAnthropicBlack HatCodexCodingCybersecurityGemini CLIGitHubGoogleNovee SecurityOpenAIVulnerability Leave a Reply Cancel reply View Comments (0) Related Posts Read More Laws & Legalities Privacy Security FBI Accessed Windows Laptops After Microsoft Shared BitLocker Recovery Keys If you are using a Windows PC, your privacy and security are nothing short of a myth, and this incident proves it. byDeeba Ahmed Read More Security Technology Critical Vulnerability Found in Samsung’s Tizen-based Smart TV Smart TV isn’t that “Smart” if you ask us. The whole idea behind a smart TV is to… byJahanzaib Hassan Read More Security Abbott to fix critical vulnerabilities in 350,000 ICDs & Pacemakers Abbott has recalled around 350,000 implantable defibrillators for firmware upgrading because these devices are identified to be containing… byWaqas Read More Security Examining the US Government’s DDoS Protection Guidance Update In March 2024, CISA, MS-ISAC, and the FBI released updated DDoS response guidance. The document outlines key strategies and 15 steps for mitigating DDoS attacks, emphasizing the need for continuous monitoring and collaboration between government and private sectors. byWaqas

Indicators of Compromise

• cve — CVE-2026-54316

Entities