Black Hat 2026: a single GitHub issue reaches CI secrets in Claude Code, Gemini CLI and Codex

What happened

Security firm Novee showed at Black Hat USA that a GitHub issue opened by an account with no repository privileges was enough to run code on the CI runners behind Anthropic's and Google's own coding-agent repositories, and to hijack the next run of OpenAI's Codex. Two CVEs resulted: CVE-2026-12537, a maximum-severity command injection in Gemini CLI's container launcher, and CVE-2026-54316, which turned Hugging Face's public download counter into a channel for leaking a Claude Code API key one character at a time.

Both CVEs are patched, in Gemini CLI 0.39.1 and the run-gemini-cli GitHub Action 0.1.22, and in Claude Code 2.1.163; the Codex finding produced no CVE, and OpenAI instead split its workflow into separate jobs, removed the checkout, added read-only sandboxes and now documents repository instruction files as untrusted input. To read the Claude Code API key out one character at a time, Novee stood up 64 attacker-controlled Hugging Face repositories, had the agent fetch from them, and watched which public download counter moved. Elad Meged, Novee's founding engineer, said the common failure sat in the harness, the code between the model and the real world, where one stage marked a value safe and a later stage acted on it with more authority. Both advisories were published in June, ahead of the talk. CISA lists no known exploitation of either CVE, on the catalogue released 27 August 2026.