Gemini CLI CVE-2026-12537 and Claude Code Flaws Turn a GitHub Issue Into CI Compromise

A single GitHub issue, opened by an account with no repository access, was enough to run code on the CI runners behind Google's and Anthropic's AI coding agents, and to hijack the next agent run on OpenAI's. The worst of the pair, Gemini CLI CVE-2026-12537, is an OS command injection rated CVSS v4.0 10.0 that executes on the CI host before the sandbox even starts. It is fixed in Gemini CLI 0.39.1 and run-gemini-cli 0.1.22, and the companion Claude Code bug (CVE-2026-54316) is fixed in 2.1.163. Novee Security demonstrated the attacks at Black Hat USA on August 5, 2026, running each vendor's agent in the exact configuration it ships by default.

The research matters because it moves the failure out of the model and into the harness, the code that sits between the model and the real world and decides what actually runs. In every case the pattern was the same: one part of the harness marked an untrusted value safe, and a later part acted on that value with more authority than it should have. That is not a prompt the model can be trained to refuse. It is a plumbing defect in the automation around the model.

Gemini CLI carried the heaviest finding. CVE-2026-12537 (NVD, CVSS 4.0 score 10.0, CWE-78) is reached through a crafted .gemini/.env file that the launcher sources before isolation is in place, letting an unprivileged attacker run commands on the host of a headless CI platform. Because it fires pre-sandbox, none of the model-side guardrails ever get a vote. In Claude Code, CVE-2026-54316 (NVD, CVSS 6.0, CWE-183) was quieter but pointed: it turned Hugging Face's public download counter into a side channel and exfiltrated an API key one character at a time. Every Claude Code release from 0.2.54 through 2.1.163 is affected, and Anthropic notes that exploitation required getting untrusted content into a Claude Code context. The Codex finding produced neither a version patch nor a CVE; OpenAI's position, per Novee, is that its sandbox behaved exactly as documented.

Why is an "allowlisted" domain still an exfiltration risk?

Because an allowlist that stops at the hostname does nothing about the path. The Claude Code channel used huggingface.co, a domain almost every ML workflow trusts, to leak a secret through a legitimate metrics endpoint. Security engineers reacting to the disclosure kept landing on the same point: agent security is not model security. If a WebFetch-style tool can reach a trusted host over any path and read any counter back, a pre-approved domain becomes an out-of-band exfiltration channel. The durable fix is egress that filters full URLs and methods, not top-level wildcards, and treating every model output as untrusted input before it reaches a shell or an API.

Should an untrusted GitHub issue ever trigger an AI agent?

Not without a human in the loop. The uncomfortable detail here is that the attacker needed no repository privileges. A public issues or pull_request_target trigger wired to an autonomous fixer means an outsider's text becomes an instruction that runs on a runner holding GITHUB_TOKEN, cloud keys, and registry credentials. Defenders are converging on ephemeral, non-privileged runners with no standing cloud credentials, micro-VM isolation, and an explicit approval gate before any externally triggered agent run executes.

What should teams do right now?

Update Gemini CLI to 0.39.1, run-gemini-cli to 0.1.22, and Claude Code to 2.1.163, then audit every workflow an outside user can trigger. Confirm that externally reachable agent jobs run without cloud credentials attached, and add a human approval step before any issue- or PR-triggered agent executes.

Our read

This is a supervised-adversary-simulation story wearing a patch note. The vendors shipped fixes, but the exposure was structural: privilege living in the harness, trust granted by hostname, secrets sitting on a runner an anonymous user could reach. A verifiable-by-design agent pipeline proves its own isolation and egress rules with evidence rather than assuming them, and logging the pre-sandbox execution context and egress decisions is exactly the audit-ready record that turns compliance into evidence. Continuous verification means testing the automation around your models the way an attacker would, from an unprivileged outside account, and treating a passing model as necessary but not sufficient. A CVSS 10.0 that never touches the model is the clearest argument yet that AI risk is an infrastructure question you can measure, not a vibe you can prompt away.

Reporting by The Hacker News; vulnerability details per Novee Security's Black Hat USA 2026 disclosure and NVD. Sources linked above.

Related: Hugging Face breach and the autonomous AI agent problem · JetBrains TeamCity CVE-2026-63077 under active exploitation