Recent findings have uncovered critical security vulnerabilities in the AI coding agents of Anthropic, Google, and OpenAI. These flaws potentially allow attackers to execute remote code, steal API credentials, and compromise software supply chains without requiring privileged access.
Discovery of Vulnerabilities
Elad Meged, a researcher at Novee Security, identified these vulnerabilities while testing the default configurations of each vendor’s coding agents on public repositories. The exposure is live and impactful, affecting millions of developers who rely on this code daily.
The crux of the issue does not reside within the AI models themselves but rather in the surrounding code that manages permissions and execution environments. A single GitHub issue, albeit from an anonymous user with no privileges, was sufficient to exploit these vulnerabilities, allowing for prompt-injection payloads that the harness failed to contain.
Implications for Continuous Integration Systems
The autonomous nature of these agents in CI/CD pipelines, where human oversight of each action is minimal, poses a significant risk. Malicious instructions could easily be hidden in issues or pull requests, leading directly to unauthorized code execution.
In Anthropic’s case, their Claude-code repository was susceptible to remote code execution due to discrepancies in command validation. Even after initial patches, further vulnerabilities were found, enabling unauthorized file access and key exfiltration.
Vendor-Specific Security Risks
Google’s Gemini CLI faced its own challenges, with a flawed shell tool allowlist and inadequate environment sanitization. These issues allowed attackers to escalate privileges and inject malicious code, prompting Google to implement major changes to their execution trust model.
OpenAI’s Codex workflow was also at risk, as it permitted attackers to manipulate the AGENTS.md file, which was trusted by subsequent runs. Although OpenAI rapidly fixed this issue by isolating workflow passes, the underlying pattern remains a concern across other platforms.
Concluding Thoughts and Recommendations
Novee Security emphasizes that these were not simple misconfigurations but rather systemic issues arising at the interfaces between different system components. The vulnerabilities were identified in over a hundred public repositories, suggesting widespread exposure.
To mitigate these risks, organizations are advised to treat all files and workflows as potentially untrusted, rather than relying on vendor defaults. Proactive security measures are crucial for safeguarding against these serious vulnerabilities.
