Black Hat 2026: AI Coding Agent CI Flaws in Claude Code, Gemini CLI, and Codex

TL;DR

At Black Hat USA 2026, Novee Security demonstrated that a single GitHub issue, the kind anyone can open on a public repo, can trigger remote code execution, steal CI secrets, and poison agent instructions across Claude Code, Gemini CLI, and OpenAI Codex. The common thread: all three tools' GitHub Actions workflows handed AI agents write-access tokens to CI runners, and an attacker-controlled issue body could reach those runners through the agent's tool-calling loop. Claude Code's flaw (CVE-2026-54316) used Hugging Face download counters as an exfiltration channel. Gemini CLI scored a perfect CVSS 10.0. All three are patched. But your workflow configurations probably are not.

What Happened

Novee Security researchers used each vendor's own public repository and default workflow configuration to demonstrate three distinct attack paths, all triggered from a single GitHub issue:

Claude Code : CVE-2026-54316 (Exfiltration via Hugging Face) Claude Code's WebFetch tool has pre-approved access to huggingface.co. The researchers crafted an issue body that caused the agent to encode API key characters into Hugging Face model download counts, one character per request. Since Hugging Face download counters are public, the attacker could read the encoded values from outside the organization. Every Claude Code release from 0.2.54 through 2.1.162 is affected. Anthropic shipped the fix in 2.1.163.

Gemini CLI : CVSS 10.0 (Full CI Runner Compromise) The @google/gemini-cli npm package and the google-github-actions/run-gemini-cli GitHub Action both passed untrusted issue content directly to the Gemini agent running on a CI runner with write tokens. The agent executed attacker-supplied commands, giving the attacker shell access on the runner and access to all repository secrets. Google fixed this in Gemini CLI 0.39.1 and run-gemini-cli 0.1.22.

OpenAI Codex : Persistent Instruction Poisoning Codex's GitHub Action allowed issue content to inject system-level instructions that persisted between separate agent invocations. An attacker who could not get code execution on the first run could plant instructions that would activate on the next CI trigger, potentially days later, when a different developer triggered the workflow.

The Shared Root Cause

All three attacks exploited the same architectural pattern: AI coding agents running in CI with write-access tokens, ingesting untrusted content (issue bodies, PR descriptions), and acting on that content through tool calls. The agents were not malicious. They were following instructions. The problem was that the instructions came from outside the trust boundary, and the workflows gave those instructions access to production secrets.

Novee's recommendation is blunt: remove write tokens from CI jobs that run AI agents, or sandbox agent execution so it cannot touch secrets, repositories, or deployment infrastructure regardless of what the issue body says.

What Developers Should Do Now

1. Update immediately. Claude Code to 2.1.163+, Gemini CLI to 0.39.1+, run-gemini-cli to 0.1.22+. These fixes block the specific exploit vectors Novee demonstrated.

2. Audit your CI workflows. If any GitHub Action runs an AI coding agent with contents: write or id-token: write, assume it is exploitable. The fixes patch the known paths, but the architectural risk remains: AI agents in CI with write tokens will execute whatever an issue body tells them to execute.

3. Sandbox agent execution. Run AI coding agents in isolated environments where they cannot access secrets, even if compromised. A dedicated CI job with read-only repository access and no secret injection is safer than a general-purpose runner.

4. Separate issue triage from code execution. If your workflow runs an agent on new issues, the agent should only read and label , never modify code, push commits, or access credentials.

5. Check for lingering poisoned instructions. Codex users whose workflows ingested untrusted issue content should review their agent configuration and system prompts for injected instructions that may have persisted across runs.

The Bigger Picture

I have been tracking AI coding tool security for months, and this is a pattern, not a one-off. We saw Ruflo's CVSS 10.0 MCP bridge flaw last week. We saw Cursor's DuneSlide RCE in July. Now three major platforms , Claude Code, Gemini CLI, and Codex , all fell to the same class of attack: untrusted input reaching an agent with too much power.

The tools are getting patched. The workflows are not. Most teams copy-pasted a GitHub Action YAML from a vendor's README six months ago and have not touched it since. Those workflows still run with write tokens. They still pipe issue bodies directly into agent prompts.

If you cannot audit your CI workflows this week, do one thing today: find every GitHub Actions job that invokes an AI coding agent and change contents: write to contents: read. It is a single-line change that breaks the entire attack class Novee demonstrated, regardless of whether your tools are patched.