Novee Security researchers presented flaws in Anthropic’s Claude Code and Google’s Gemini CLI at Black Hat USA on August 5, showing how an attacker-controlled GitHub issue can reach workflow secrets inside an AI coding agent’s CI environment. Gemini stores a maximum-severity command injection flaw, and Claude Code can be tricked into exfiltrating data through a trusted telemetry endpoint.
The CVSS 10.0 Gemini CLI Command Injection and Its Fixes
CVE-2026-12537, rated CVSS 10.0, is a command injection in Gemini CLI. Malicious content in a user’s project or its .gemini and .env file lets crafted content lead to arbitrary command execution. The fix ships in Gemini CLI 0.39.1 and run-gemini-cli 0.1.22.
The Claude Code Telemetry-Endpoint Data Exfiltration Path
CVE-2026-54316 affects Claude Code in every release from 0.2.54 through 2.1.163. The agent can be tricked into exfiltrating data through its Hugging Face download counter, a telemetry endpoint abused to enable data theft through a trusted tool integration. The fix is bundled in Claude Code 2.1.163. Researchers also identified a separate finding in OpenAI’s Codex agent.
How a GitHub Issue Reaches CI Secrets Through the Agent
The demonstrated chain starts with attacker-controlled GitHub issue or pull-request content. That content becomes input to an AI coding agent working inside a CI environment, and because the agent holds access to the build pipeline to complete its task, the untrusted content pushes the agent across the boundary from repository data into the credential-bearing environment where workflow secrets live.
Why Repository Content Is Now an Active Input Vector
The finding reframes repository data as an input subject. An issue, pull request, or configuration file read by an AI agent is a way to steer the agent toward CI secrets, and the malicious instruction travels not through a network flaw but through the agent’s tendency to act on content it is asked to review. This is a content-injection path into credential-bearing environments.
What the Claude Code and Gemini Findings Mean for Developer Pipelines
For organizations adopting AI coding tools, the results expand the attack surface beyond the conventional developer workflow. The agent becomes a new interpreter of untrusted content, and its access to CI secrets is the prize an attacker seeks.
Patches, Least Privilege, and Telemetry Monitoring
Organizations should update Claude Code to 2.1.163 or later and Gemini CLI to 0.39.1 or later, including run-gemini-cli 0.1.22. Treat repository content — issues, pull requests, and configuration files — as untrusted input to agents, scope CI credentials to least privilege, and monitor agent telemetry egress. The combination of the CVSS 10.0 command injection and the telemetry-abuse path is why these updates are urgent, especially for teams running a coding agent as part of their build.
The two flaws expose a tension at the center of agentic development: the integration tokens that make a coding agent useful — its ability to read a repository and act on it — are the same channel through which an attacker can steer it toward credentials. Because the attack needs no stolen login and no flawed protocol, the mitigation is not a patch that removes the capability but the discipline of scoping what the agent can reach and treating repository content as untrusted. As coding agents become the default interface to build pipelines, that discipline is the difference between a convenience tool and a supply-chain exposure.
The research also exposes the gap between how quickly these tools are adopted and how little visibility security teams have into their runtime behavior. A developer may run an agent against a public issue thread without realizing the content of that thread is now input to a system holding pipeline credentials. Until agent runtimes give defenders consistent visibility into which repository objects triggered which tool calls, the practical mitigation remains operational: verify that the CI environment grants the agent only the secrets it needs for the specific job, and watch the telemetry endpoints the agent is allowed to use, since the Claude Code finding shows a trusted counter can double as an exfiltration channel.
