Claude Code Vulnerabilities and Gemini CLI Flaws Expose CI/CD Pipelines

At Black Hat USA 2026, security research firm Novee Security delivered a stark wake-up call to the software development industry by exposing systemic flaws in autonomous AI developer tools. Disclosed in full on August 7, 2026, the research highlights how zero-privilege public inputs—such as a standard GitHub issue or pull request—can compromise Continuous Integration and Continuous Deployment (CI/CD) pipelines. At the epicenter of this revelation are severe Claude Code vulnerabilities, alongside critical exploits in Google’s Gemini CLI and OpenAI’s agent integrations. Rather than exposing flaws in the underlying Large Language Models (LLMs) themselves, the findings expose catastrophic trust assumptions within the software harnesses built to translate model intent into system-level actions. In default headless workflows, an unprivileged attacker on the internet can leverage a simple text box to achieve remote code execution (RCE), siphon high-privilege repository tokens, and permanently hijack downstream automated developer runs.

The implications for the modern software supply chain are staggering. As enterprises rush to deploy autonomous agents across GitHub Actions, GitLab CI, and cloud infrastructure, developers have systematically granted these tools elevated privileges to manage pull requests, triage issues, run test suites, and publish packages. The research presented by Novee Security founding engineer Elad Meged demonstrates that when AI coding assistants process untrusted external data without strict isolation boundaries, the security model completely breaks down. By exploiting the handoff logic between intent validation and execution, attackers can pivot from an anonymous GitHub issue directly into the host execution environment powering critical software repositories.

The “Harness” Architecture: Where AI Agent Security Fails

To understand why these vulnerabilities emerged simultaneously across industry-leading vendors, one must examine the operational architecture of an autonomous AI coding agent. An agent is fundamentally comprised of two distinct layers:

• The Model Layer: The underlying LLM (such as Claude 3.5 Sonnet, Gemini 1.5 Pro, or GPT-4o) responsible for processing text, reasoning about task context, and generating intent or code snippets.
• The Harness Layer: The wrapper code surrounding the model that acts as the execution bridge. The harness reads contextual inputs, handles tool definitions, validates shell commands, manages directory path permissions, and executes OS-level calls on the host or runner environment.

While security teams have spent years focusing on prompt injection defense at the model layer, the Black Hat disclosure proves that the harness itself is the primary attack surface. In automated CI/CD runners, the harness acts with elevated authority—frequently holding live environment variables like ANTHROPIC_API_KEY, GITHUB_TOKEN, or production deployment credentials. When an attacker feeds malicious input through an unprivileged channel, the harness accepts the LLM’s generated commands under the flawed assumption that previous validation checks rendered the payload safe. The failure occurs during the inter-component handoff, where sanitization logic at one stage fails to constrain execution privileges in the next.

Deconstructing Claude Code Vulnerabilities: From Command Bypass to Out-of-Band Exfiltration

The disclosures surrounding Anthropic’s developer tool, tracked primarily under CVE-2026-54316, offer a masterclass in how layered defenses can fall victim to subtle logic flaws. Affecting Claude Code releases from version 0.2.54 through 2.1.162 (and remediated in version 2.1.163), the vulnerability path required Anthropic to issue multiple iterations of fixes as researchers iteratively bypassed initial patches.

Initially, Novee Security discovered that an attacker could place hidden prompt injection instructions inside a public GitHub issue opened against a repository utilizing the claude-code-action workflow. When Claude Code picked up the issue to triage or attempt a fix, the injected instructions coerced the agent into executing a specialized git push command. While Anthropic had instituted a 23-point command validator to filter dangerous shell commands, the validation engine stripped single-quoted text prior to running its safety checks—mirroring standard Bash behavior. However, an attacker could craft a payload abusing Git’s native receive-pack option inside the command string. This allowed arbitrary command execution directly on the GitHub Actions runner, exposing both the repository’s GITHUB_TOKEN and Anthropic API keys