A GitHub issue opened by an account with no repository privileges was enough to execute code on the CI runners behind Anthropic's and Google's own coding-agent repositories. On OpenAI's, it was enough to hijack the next agent run.
Novee Security ran the attack against each vendor's agent in the configuration that the vendor ships by default. The researchers presented their work at Black Hat USA on August 5. The Claude Code Gemini CLI vulnerabilities include two CVEs, both of which are now patched.
Let me walk through the Claude Code Gemini CLI vulnerabilities, what they affect, and what you need to do.
The Gemini CLI Vulnerability: CVE-2026-12537
The first of the Claude Code Gemini CLI vulnerabilities affects Google's Gemini CLI. CVE-2026-12537 carries the highest severity. It is an OS command injection in the container launcher, reached through a crafted .gemini/.env file.
This vulnerability lets an unprivileged attacker run code on the host of a headless CI platform before the sandbox starts. The CVSS v4 score is 10.0, the highest possible rating.
The Claude Code Gemini CLI vulnerability is fixed in Gemini CLI 0.39.1 and run-gemini-cli 0.1.22. The Gemini host-execution bug did not require talking a model into anything. The failure sat in the harness, the code around the model that decides what actually runs.
Google addressed both that and the container-launcher flaw in one advisory. The fix "affects all Gemini CLI GitHub Actions." Google Cloud published the CVE identifier separately, pointing back to it.
The Claude Code Vulnerability: CVE-2026-54316
The second of the Claude Code Gemini CLI vulnerabilities affects Anthropic's Claude Code. CVE-2026-54316 turned Hugging Face's public download counter into an exfiltration channel that leaked an API key one character at a time.
Every Claude Code release from 0.2.54 up to 2.1.163 is affected. Anthropic says exploitation required getting untrusted content into a Claude Code context. The vulnerability is fixed in Claude Code 2.1.163.
The Claude Code Gemini CLI vulnerability has a split severity rating. Anthropic rates it Moderate at CVSS v4 6.0. NVD assigned a CVSS v3.1 score of 9.1. NVD has not scored it under v4, so the two figures are not a like-for-like comparison.
The Codex Finding
The Codex finding produced neither a product-version patch nor a CVE. Novee says OpenAI's position is that its sandbox behaved exactly as documented.
Novee found that the openai/codex repository ran two Codex passes inside a single job sharing one checkout. The first pass could write AGENTS.md, the file the second pass loads as its own instructions. Failing the JSON validation between the passes is what launched the second one.
OpenAI's current workflow separates the passes into different jobs and runs Codex with drop-sudo and a read-only sandbox. OpenAI's guidance now lists repository instruction files among content that "should be considered part of the untrusted input surface." The company recommends running Codex as the last step in a job, warning that it may otherwise leave files behind for privileged steps that follow.
Neither change shows that Codex itself now handles a writable instruction file differently. The sources establish a repository-level workflow fix and a documentation update.
The Common Thread: Harness Vulnerabilities
Across all three Claude Code Gemini CLI vulnerabilities, the recurring failure sat in the harness. The harness is the code between the model and the real world. One part marked a value safe, and a later part acted on that value with more authority.
Novee found that Claude Code's command validator strips single-quoted text before its 23 checks run. This is correct behavior for bash. A payload in the value of git push --receive-pack, a flag git executes, reached the runner untouched. That chain has no CVE and no publicly stated fixed version.
Gemini CLI parsed its tool allowlist only when registering the tool. At runtime nothing enforced it. Under --yolo every command the model asked for was auto-approved. This combination made the Claude Code Gemini CLI vulnerability particularly dangerous.
The Public Reproduction Lab
The Hacker News confirmed on August 7 that a public GitHub repository describing itself as a reproduction lab for the Claude Code flaw has been up since June 18. This means the technical details of the Claude Code Gemini CLI vulnerability have been publicly available for over a month.
Nothing in the sources reviewed shows either chain used against a target. CISA's entry on both the Gemini and Claude Code CVE records lists exploitation as none. Neither appears in the agency's Known Exploited Vulnerabilities catalog.
The ChainDrop Connection
The Claude Code Gemini CLI vulnerabilities disclosure comes as Pillar Security reported on August 4 that the operators of the ChainDrop npm worm planted a Claude Code SessionStart hook and a VS Code folderOpen task in compromised repositories. These hooks fire when a developer opened the workspace rather than waiting for an install.
This is a different attack vector but highlights the same theme: Claude Code can be exploited through untrusted content. The hooks demonstrate that attackers are actively thinking about how to abuse AI coding agents.
What Administrators Should Do
The Claude Code Gemini CLI vulnerabilities require immediate action for organizations using these tools.
For Gemini CLI:
- Update to Gemini CLI 0.39.1
- Update run-gemini-cli to 0.1.22
- The fix affects all Gemini CLI GitHub Actions
For Claude Code:
- Update to Claude Code 2.1.163
- Every release from 0.2.54 up to 2.1.163 is affected
For Codex:
- No patch is available
- OpenAI's workflow fix separates passes into different jobs
- Run Codex as the last step in a job
- Treat repository instruction files as untrusted input
The Broader Implications
The Claude Code Gemini CLI vulnerabilities point to an emerging issue, namely that AI coding agents are powerful tools which pose security threats. The code around the model the harness is often where vulnerabilities hide.
The harness decides what actually runs. If the harness trusts values it should not trust, an attacker can bypass security controls. The Claude Code Gemini CLI vulnerabilities demonstrate that the harness is a critical attack surface.
The fact that a GitHub issue from an account with no privileges could execute code on CI runners is remarkable.It indicates that organizations should take into consideration who can initiate agent-based workflow process and what agents can do.
Wrapping It Up
The Claude Code Gemini CLI vulnerabilities include two CVEs affecting Google's Gemini CLI and Anthropic's Claude Code. CVE-2026-12537 is a critical OS command injection in Gemini CLI. CVE-2026-54316 is an exfiltration channel in Claude Code.
Both vulnerabilities are patched. Update Gemini CLI to 0.39.1 and Claude Code to 2.1.163. For Codex, follow OpenAI's workflow guidance.
The vulnerabilities are not known to be exploited in the wild, but the public reproduction lab and ChainDrop hooks show that attackers are aware of the risks. Organizations using AI coding agents should treat them as potential attack surfaces and secure their harnesses accordingly.
FAQ Section
What are the Claude Code Gemini CLI vulnerabilities?
CVE-2026-12537 is an OS command injection in Gemini CLI's container launcher allowing code execution on the host. CVE-2026-54316 is an exfiltration channel in Claude Code leaking API keys via Hugging Face counters.
Which versions are affected by the Claude Code Gemini CLI vulnerabilities?
Gemini CLI versions before 0.39.1 and run-gemini-cli before 0.1.22 are affected. Claude Code releases from 0.2.54 up to 2.1.163 are affected. Codex has a workflow issue but no CVE.
What is the Claude Code vulnerability?
CVE-2026-54316 turns Hugging Face's public download counter into an exfiltration channel. It leaks API keys one character at a time. Fixed in Claude Code 2.1.163.
What should I do if I use these tools?
Update Gemini CLI to 0.39.1 and run-gemini-cli to 0.1.22. Update Claude Code to 2.1.163. For Codex, separate workflow passes into different jobs and run Codex as the last step.
Have these vulnerabilities been exploited?
CISA lists exploitation as none. Neither CVE appears in the Known Exploited Vulnerabilities catalog. However, a public reproduction lab for the Claude Code flaw has been available since June 18.
