Recent discoveries have unveiled significant security vulnerabilities in the Gemini CLI and Claude Code, impacting the CI workflows of major tech entities like Anthropic and Google. These flaws have prompted the release of critical patches, emphasizing the importance of securing coding-agent repositories against unauthorized code execution.
Exploiting CI Workflows: A Closer Look
A GitHub issue, initiated by a user lacking repository privileges, managed to execute code on CI runners associated with Anthropic’s and Google’s repositories. Investigations by Novee Security, presented at the Black Hat USA conference on August 5, revealed the extent of these vulnerabilities. The Gemini CLI flaw, registered as CVE-2026-12537, was particularly severe, boasting a CVSS score of 10.0. This vulnerability allowed OS command injection through a manipulated .gemini/.env file, leading to unauthorized code execution on CI hosts.
The issue has been addressed in Gemini CLI version 0.39.1 and run-gemini-cli version 0.1.22. Meanwhile, Claude Code’s vulnerability, identified as CVE-2026-54316, exploited Hugging Face’s download counter to leak API keys. This flaw affected every Claude Code version from 0.2.54 to 2.1.163 and required the presence of untrusted content within the code context to be exploited.
Details of the Vulnerabilities
The Gemini CLI’s execution bug was traced back to a failure in the harness code that improperly handled value safety checks. As Novee’s founding engineer Elad Meged explains, this harness acts as the intermediary between a model and the real world, highlighting the critical role of secure code execution frameworks.
Google addressed the Gemini CLI vulnerabilities by revamping its tool registration process and implementing stricter runtime checks. Despite these efforts, the advisory did not initially provide a CVE, though Google Cloud later published one separately. Anthropic rated the Claude Code vulnerability with a CVSS v4 score of 6.0, while the NVD assigned a v3.1 score of 9.1, reflecting differing assessments of the risk involved.
Future Outlook and Recommendations
Novee Security’s findings on OpenAI’s Codex revealed issues with how two passes were executed within a single job, allowing potential manipulation of instruction files. OpenAI has since modified its workflows to separate these passes and ensure secure execution, emphasizing the need for cautious handling of repository instruction files.
Despite the severity of these vulnerabilities, there has been no evidence of exploitation in the wild, as confirmed by CISA and The Hacker News. However, developers are urged to update affected versions promptly and review any workflows that external users can trigger. The ongoing developments underscore the importance of maintaining rigorous security measures to prevent similar vulnerabilities from being exploited in the future.
