On August 6, 2026 Elad Meged of Novee Security published findings against the default configurations of three widely used coding agents: Anthropic’s Claude Code, Google’s Gemini CLI and OpenAI’s Codex. The tests were run against the vendors’ own public repositories, so the exposure was in shipped defaults rather than in a contrived setup.
Claude Code went through three sequential rounds of patch and bypass. The first was remote code execution via git push flag injection using single-quoted payloads. The second was arbitrary file reads through the tac command, which sat in the agent’s READ_ONLY allowlist but was missing from its PATH_CHECKED list. The third was API key exfiltration that used a Hugging Face download counter as a side channel, recovering the key one character at a time. The final round was assigned CVE-2026-54316.
Gemini CLI was rated CVSS 10.0 under advisory GHSA-wpqr-6v78-jr5g. The run shell command tool prefix-matched command strings without enforcing the restrictions it appeared to apply, and although the child process environment was sanitised, the parent process environment remained readable through /proc/$PPID/environ. Novee frames the blast radius as a supply-chain problem, citing roughly two million monthly installs downstream. Google responded with a breaking change to the trust model for headless execution. In Codex, a writable AGENTS.md file in a shared workspace let instructions injected during one pass of an automated workflow be executed by a later pass; OpenAI split the work into separate jobs with independent checkouts and enforced a read-only sandbox.
The common shape across all three is worth internalising: the agent treats repository content as configuration, and an automated workflow that reads an untrusted issue, branch or instruction file is executing attacker input with the credentials of whoever set up the job. Teams running coding agents in CI should assume that any writable instruction file is code, that allowlists of shell commands are not a boundary unless every path through them is checked, and that the agent’s environment must not contain a secret it does not need. Pinning agent versions and reading vendor advisories now matters as much as pinning dependencies.