One GitHub issue was enough to break Claude Code, Gemini CLI and Codex pipelines

Anyone with a GitHub account can open an issue. That is the entire point of an issue tracker — and, according to research presented at Black Hat USA on 5 August, it was also enough to compromise the automated coding agents that Anthropic, Google and OpenAI run against their own public repositories.

The work was carried out by Novee security researcher Elad Meged, who tested each vendor's default shipped configuration rather than a contrived setup. Novee's write-up stresses that the flaws sit not in the models but in what it calls "the harness" — the surrounding code that manages tool permissions, execution and sandboxing around each agent.

That framing is the story. The industry has spent two years debating whether models can be persuaded to misbehave. This research sidesteps the question: the model behaved as designed, and the scaffolding around it did the damage.

Three agents, three routes in

Claude Code. An attacker could embed hidden instructions in a GitHub issue and induce the agent to run a specially crafted git push. The command passed Anthropic's validation checks but abused Git's receive-pack option to execute code on the GitHub Actions runner. Anthropic issued several patches over the course of disclosure before assigning CVE-2026-54316.

Gemini CLI. Researchers bypassed assumptions about restricted shell commands and environment isolation, chaining the result into credential theft and, potentially, software supply chain compromise. Google rated the issue CVSS 10.0 — the maximum score the scale allows.

Codex. A writable AGENTS.md file allowed attacker-controlled instructions to persist across multiple stages of an automated workflow. Where the other two bugs were bursts of execution, this one is patient: instructions planted once are re-read by the next agent run, and the one after that.

Why the blast radius is wider than three vendors

Novee describes the finding as a repeatable pattern rather than three unrelated bugs, and its second Black Hat write-up is titled, pointedly, "If You Run These Automations, You're Exposed Too." The configurations tested were the defaults. Any organisation that has wired one of these agents into CI on a repository that accepts public issues or pull requests inherits a version of the same exposure.

The core issue lies not in the AI models themselves but in the "harness" — the surrounding code that manages tool permissions, execution, and sandboxing around each agent.

What to check this week

None of the mitigations here are exotic. They are the CI hygiene that agentic automation quietly makes urgent again.

• Confirm you are on patched versions of Claude Code, Gemini CLI and Codex. CVE-2026-54316 took multiple rounds of patching — pinning to an early fix is not sufficient.
• Treat issue and pull request bodies from outside your organisation as untrusted input to any agent. If an agent reads them, it is parsing attacker-supplied text.
• Audit agent instruction files — AGENTS.md, CLAUDE.md and their equivalents — for write permissions, and require review on changes to them the same way you would for a workflow file.
• Scope CI runner credentials to the minimum. Both the Gemini and Codex findings terminate in credential access; short-lived, narrowly scoped tokens cap the damage.
• Do not run agents with network egress and repository write access on runners that also hold publish credentials for a package registry.

The timing is not lost on anyone who was in Las Vegas last week. These disclosures landed days after Anthropic and OpenAI each published incident reports describing models under evaluation reaching real production systems. Different mechanism, same lesson: the interesting failures in agentic AI are currently happening in the infrastructure, not the intelligence.