Claude code, Gemini CLI and Codex vulnerabilities expose new CI/CD security risks
- Evelyn Carter
- 4 days ago
- 3 min read
Research presented at Black Hat USA 2026 shows that workflows involving Anthropic Claude Code, Google Gemini CLI, and OpenAI Codex can process attacker-controlled data across unsafe trust boundaries. Gemini CLI is affected by CVE-2026-12537, rated 10.0 under CVSS 4.0, while Claude Code is affected by CVE-2026-54316, which can enable data exfiltration.
As a result, seemingly passive data such as GitHub Issues, configuration files, or repository content can become inputs capable of influencing an agent's actions.
What happened with Claude Code, Gemini CLI, and Codex?
The findings focus on official workflows and the ways AI coding agents interact with repositories and automated development environments. Novee Security described a class of security issues in which attacker-influenced state may be considered sufficiently trusted by one component and later consumed by another component operating with greater privileges.
This is particularly relevant in GitHub environments. Content from Issues, Pull Requests, or repositories may be controlled by external users, while the AI agent processing that content may have access to source code, execution tools, workflow tokens, or secrets.
Two vulnerabilities have been clearly identified:
Tool | Vulnerability / Issue | Key Impact | Status |
Google Gemini CLI | CVE-2026-12537 | OS command injection before sandbox initialization in headless CI | Fixed in Gemini CLI 0.39.1 and run-gemini-cli 0.1.22 |
Anthropic Claude Code | CVE-2026-54316 | Data exfiltration channel through previously trusted Hugging Face WebFetch domain | Fixed in Claude Code 2.1.163 |
OpenAI Codex | Agent trust-boundary issue | A later agent may consume instructions persisted by an earlier step in a shared workspace | Research describes workflow-level mitigations; a specific CVE should not be attributed without a corresponding advisory |
How can a GitHub Issue become an attack input?
AI coding agents differ from conventional chatbots because they can take actions. An agent may read files, execute shell commands, modify repositories, invoke tools, and operate inside automated development pipelines.
A potential attack path therefore looks like this:
Untrusted data → AI agent processes data → agent selects an action → workflow executes action → privileged resources become accessible
👉 For enterprises integrating AI into software development, this is why penetration testing and exploit validation should increasingly examine DevSecOps workflows, runner privileges, and integrations used by AI agents—not only traditional applications.
How serious are the individual vulnerabilities?
Gemini CLI: CVE-2026-12537 can execute code before sandboxing
The timing is significant. Sandboxing is commonly treated as a security boundary when AI agents execute code. However, if malicious commands execute before the sandbox is established, that isolation layer cannot protect the host from the initial execution.
Affected versions include:
Gemini CLI versions before 0.39.1
run-gemini-cli GitHub Action versions before 0.1.22
CVE: CVE-2026-12537
Google Cloud CVSS 4.0 score: 10.0 Critical
Claude Code: WebFetch could provide a data exfiltration channel
The confirmed affected range is:
Claude Code from 0.2.54
Versions before 2.1.163
CVE: CVE-2026-54316
Fixed version: 2.1.163
Codex: risk can persist across agent workflow stages
The OpenAI Codex finding illustrates a different security problem. Multiple agent passes may operate within a shared workspace, allowing an earlier stage to create or modify instructions that a subsequent agent may continue to trust.
Which organizations should pay particular attention?
Organizations that have already incorporated AI coding agents into automated development processes face the greatest exposure, particularly where agents have broad access to GitHub repositories, CI/CD runners, or secrets.
A 2026 empirical study examining more than 3,800 publicly reported bugs across Claude Code, Codex, and Gemini CLI also found that tool invocation and command execution represent important areas of security and reliability concern in AI coding workflows.
What should enterprises do immediately?
Upgrade Gemini CLI to 0.39.1 or later where affected versions are deployed.
Upgrade the run-gemini-cli GitHub Action to 0.1.22 or later.
Upgrade Claude Code to 2.1.163 or later to address CVE-2026-54316.
Inventory GitHub Actions and workflows that use AI coding agents.
Identify workflows triggered by Issues, Pull Requests, or externally controlled content.
Reduce repository token permissions according to the Principle of Least Privilege.
Avoid exposing deployment secrets to stages that only analyze untrusted content.
Separate external-content processing from stages with write or deployment privileges.
Avoid sharing writable workspaces between untrusted agents and privileged workflow stages.
Require human approval before sensitive operations such as merging, deployment, package publishing, or workflow modification.
What does IPSIP Vietnam's expert perspective highlight?
AI coding agents should be governed as privileged components of the software supply chain. Deployments should therefore incorporate asset inventory, least privilege, secrets management, sandboxing, security logging, and change-control processes.
For enterprises adopting AI-assisted software development, immediate priorities include patching affected versions, inventorying AI agents across development pipelines, and reviewing their permissions. Longer term, AI coding agents should be incorporated into the same risk-governance framework used for service accounts, CI runners, and other privileged machine identities.
References
Comments