A single researcher testing the public repositories of three major AI coding agent vendors has turned up a strikingly consistent vulnerability pattern: flaws that let an attacker with zero privileges achieve remote code execution, steal API credentials, and potentially compromise the software supply chain, all by opening a single GitHub issue.

The findings, from Novee Security researcher Elad Meged, span Anthropic’s Claude Code, Google’s Gemini CLI, and OpenAI’s Codex. Because the testing was performed against each vendor’s own default configuration on their own public repositories, the exposure wasn’t theoretical — it reflected the exact code millions of developers use today.

The Common Root Cause: The Harness, Not the Model

Meged’s research points to a shared weak point that has nothing to do with the underlying language models themselves. Instead, the problem lives in what’s often called the “harness” — the surrounding code responsible for managing tool permissions, execution, and sandboxing around each AI agent. In each case tested, an anonymous GitHub issue opened by a stranger with no repository access was enough to smuggle a prompt-injection payload past the harness’s defenses. Because these agents frequently operate autonomously inside CI/CD pipelines with no human reviewing every action, a malicious instruction buried in an issue or pull request could travel straight through to code execution.

Anthropic’s Claude Code: Patched, Then Bypassed Twice

On Anthropic’s own claude-code repository, researchers achieved remote code execution by exploiting a mismatch between Claude’s command-validation logic and how the shell actually interprets quoted strings, using a malicious git push --receive-pack flag to slip past twenty-three separate security checks and execute arbitrary code on the runner.

After Anthropic patched the issue, researchers found a second bypass using the read-only tac command to read arbitrary files, exfiltrating a reversed API key through a public GitHub Actions log. A third technique used HuggingFace’s public download counter as a covert side channel, leaking an API key one character at a time. That final chain was assigned CVE-2026-54316.

Google’s Gemini CLI: A CVSS 10.0 Supply Chain Risk

Google’s Gemini CLI, running on a repository with more than 106,000 stars and roughly two million monthly installs, suffered from two compounding flaws. A “restricted” shell tool allowlist was never actually enforced at runtime, and an environment-sanitization scheme that was supposed to strip secrets from the child process left them fully readable in the parent process via /proc. Combining unrestricted shell access with easily readable credentials let attackers escalate from a single anonymous issue all the way to pushing malicious code directly into the main branch — a flaw Google rated CVSS 10.0 in its own advisory and fixed with a breaking change to its headless execution trust model.

OpenAI’s Codex: A Persistent Cross-Pass Hijack

OpenAI’s Codex workflow on its own repository ran two agent passes sharing a single workspace. OpenAI had already protected sensitive directories like .git and .codex from tampering, but overlooked AGENTS.md, the default instruction file the agent loads and trusts on every run. Attackers could poison this file during the first pass so the second, supposedly “safe” pass inherited malicious instructions along with whatever elevated permissions or tokens it carried. OpenAI fixed its own repository within three days by separating the two passes into isolated jobs, though researchers caution that the underlying multi-pass agent pattern remains widely copied elsewhere.

A Pattern That Extends Far Beyond Three Vendors

Novee Security emphasizes that none of these were simple misconfigurations — they were reasonable security decisions that broke down at the handoff points between different parts of each system. The firm found the same vulnerable default patterns running on more than a hundred public repositories beyond the three vendors directly tested, meaning many organizations running these coding agents in automation likely inherited the same exposure without realizing it.

The researchers’ core recommendation is a shift in mindset: treat every file a workflow writes, and every workflow itself, as an untrusted input surface, rather than assuming a vendor’s default configuration is inherently safe. As AI coding agents become a standard part of CI/CD pipelines, the incident is a reminder that agent autonomy without rigorous sandboxing can turn a routine GitHub issue into a full pipeline compromise.