Researchers at Novee Security reported a serious CI secrets risk scenario: a GitHub issue created by an account without repository privileges was still enough to reach CI runners behind coding-agent repositories. In other words, the weakness did not rely on access to the repository itself—it focused on how agent workflows decide what is safe to run and how that decision is enforced.
They tested the vendor configurations that ship by default, presented the work at Black Hat USA on August 5, and published two CVEs. Both issues are patched, and the findings also include additional evidence that workflow design and harness behavior are critical when using agent tools in automated pipelines.
Why a GitHub issue could affect CI runners
The core theme across the findings was the “harness”—the glue code that sits between an agent model and the real execution environment. Even when parts of the system mark something as safe, later stages may still grant more authority than intended.
Novee’s work highlights that this gap can turn seemingly harmless inputs into real execution. As Elad Meged, Novee’s founding engineer, put it: the harness is the code between the model and the real world.
Gemini CLI: host command injection via crafted env file
Among the two published CVEs, Gemini CLI showed the more severe behavior. The issue is tracked as CVE-2026-12537 (CVSS 4: 10.0) and is described as an OS command injection in the container launcher.
In Novee’s scenario, the path to exploitation involved a crafted .gemini/.env file. That input allowed an unprivileged attacker to run code on the host of a headless CI platform before the sandbox had started.
What you should update
Google addressed the problem, and Novee reported that the fix is available in:
- Gemini CLI 0.39.1
- run-gemini-cli 0.1.22
The advisory also states that the fix affects all Gemini CLI GitHub Actions. Notably, the advisory itself did not list a CVE in the same way, but a separate identifier was published by Google Cloud and referenced back as part of the CNA process.
Claude Code: exfiltration through Hugging Face counter
The second published CVE concerns Claude Code. It is tracked as CVE-2026-54316. Novee found that a public download counter on Hugging Face could be used as an exfiltration channel.
In the reported chain, the leakage occurred one character at a time, ultimately disclosing an API key. Anthropic rated the issue as Moderate with a CVSS v4 score of 6.0, while an older NVD scoring under CVSS v3.1 shows 9.1. NVD had not provided a v4 score at the time of reporting, so the numbers are not directly comparable.
Version range and patch
Novee reported that every Claude Code release from 0.2.54 up to 2.1.163 is affected. Anthropic also stated that exploitation required placing untrusted content into a Claude Code context.
The fix is available in Claude Code 2.1.163.
Not every finding becomes a CVE: Codex workflow behavior
Beyond the Claude Code and Gemini CLI issues, Novee also described a Codex finding related to how the OpenAI codex repository runs multiple passes inside the same job.
Unlike the other two, this Codex issue did not produce a product-version patch or a CVE record. Instead, Novee’s findings indicate a workflow-level problem: two Codex passes were performed within a single job sharing one checkout. The first pass could write AGENTS.md, and the second pass then loaded that file as its own instructions.
The chain relies on failing JSON validation between the passes, which then allowed the second pass to start under conditions that were not intended.
How OpenAI is addressing Codex: job separation and untrusted input
OpenAI’s response, as described in the report, focuses on workflow structure rather than a single version bump. The updated guidance separates the Codex passes into different jobs and runs Codex with drop-sudo and a read-only sandbox.
OpenAI’s guidance also emphasizes repository instruction files as part of the untrusted input surface. Additionally, it recommends running Codex as the last step in a job and warns that running it earlier can leave files behind that may later be used by more privileged steps.
Importantly, the report does not claim that Codex itself now validates writable instruction files differently. What’s documented is a repository-level workflow fix and a documentation update intended to reduce the impact of shared state across steps.
What the “harness” problems looked like in practice
Novee’s analysis suggests that both toolchains suffered from a general pattern: safety checks were either incomplete at runtime or could be bypassed by how input values were later interpreted.
Claude Code: command validation and a runner-path bypass
For Claude Code, Novee reported that the command validator strips single-quoted text before its validation checks run. This behavior is consistent with how bash handles single quotes. However, Novee’s report indicates that a payload placed into the value for something like git push –receive-pack could reach the runner without being altered in time to prevent the subsequent execution path.
This portion of the chain was described as not having a publicly stated fixed version and not being tied to a CVE of the same form as the other issue.
Gemini CLI: allowlist checks not enforced after registration
For Gemini CLI, Novee described a deeper enforcement gap. The tool allowlist was parsed only at the moment of registering a tool; at runtime, nothing enforced the allowlist again. Under –yolo, commands requested by the model were auto-approved, weakening the safety boundary.
Google’s advisory addressed both this runtime enforcement issue and the container-launcher flaw in the same fix guidance for Gemini CLI GitHub Actions.
Was this exploited in the wild?
According to the report, CISA entries for both Gemini and Claude Code CVE records list exploitation as none. The Hacker News also confirmed on August 7 that neither issue appeared in CISA’s Known Exploited Vulnerabilities catalog.
The researchers also referenced a public GitHub repository described as a reproduction lab for the Claude Code flaw, which had been available since June 18 at the time of writing. However, the reviewed sources did not show evidence that either described chain was used against a target.
Additional warning: compromised repos can trigger agent tasks
Finally, the news came alongside another report from Pillar Security: operators of the ChainDrop npm worm planted a Claude Code SessionStart hook and a VS Code folderOpen task in compromised repositories. The hooks were designed to trigger when a developer opened the workspace, rather than waiting for an install.
This reinforces a broader lesson for CI and developer tooling: assume that untrusted repository content may execute at multiple lifecycle points, not only during dependency installation.
Practical next steps to reduce CI secrets risk
If you use agent tooling in CI, the report provides clear, actionable items—especially for Gemini and Claude Code:
- Update Gemini CLI to 0.39.1 and run-gemini-cli to 0.1.22.
- Update Claude Code to 2.1.163 (and consider reviewing how you pass untrusted content into agent contexts).
- Audit workflows that outsiders can trigger, including those started from GitHub events or user-controlled content.
- Review harness and enforcement boundaries—especially where tool allowlists or safety checks are applied only at setup time.
- For Codex-style setups, follow guidance to separate passes into different jobs and treat repository instruction files as untrusted input.
By combining upgrades with workflow hardening, you directly reduce the chance that a CI pipeline becomes a pathway to secrets exposure.
Conclusion
The report makes one message hard to ignore: a CI secrets risk can emerge not just from credential leaks, but from how agent workflows translate input into real execution. Gemini CLI and Claude Code both had problems rooted in harness behavior and enforcement gaps, and both have available fixes. Meanwhile, the Codex findings underline that workflow design—job separation, sandboxing, and untrusted input boundaries—often matters as much as the tool itself.
Source: https://thehackernews.com/2026/08/claude-code-and-gemini-cli-flaws-let.html
