Recent research has uncovered significant security vulnerabilities in AI coding agents developed by leading tech companies, including Anthropic, Google, and OpenAI. These flaws enable attackers to execute remote code, steal API credentials, and compromise software supply chains without requiring privileged access.
The vulnerabilities were identified by Novee Security researcher Elad Meged, who tested each vendor’s default configurations on their public repositories. This indicates that the exposure is not merely theoretical but actively present in the codebases utilized by millions of developers.
Underlying Issues in AI Agent Harnesses
The primary concern lies not within the AI models themselves but in the surrounding code—referred to as the “harness”—that manages tool permissions, execution, and sandboxing for each agent. Meged discovered that a single GitHub issue, submitted by an anonymous user without any privileges, could trigger the agent and introduce prompt-injection payloads that the harness failed to contain adequately. Given that these agents often operate autonomously within Continuous Integration/Continuous Deployment (CI/CD) pipelines without human oversight, a malicious instruction embedded in an issue or pull request can lead directly to code execution.
Specific Vulnerabilities Identified
In Anthropic’s Claude Code repository, researchers achieved remote code execution by exploiting a discrepancy between Claude’s command validation logic and the shell’s interpretation of quoted strings. This allowed a malicious git push –receive-pack flag to bypass multiple security checks and execute arbitrary code on the runner. Despite Anthropic’s initial patch, subsequent bypasses were found, including one that used the tac command to read arbitrary files and exfiltrate a reversed API key through a public GitHub Actions log. Another method leveraged Hugging Face’s public download counter as a covert channel to leak an API key character by character, leading to the assignment of CVE-2026-54316.
Google’s Gemini CLI, associated with a repository boasting over 106,000 stars and approximately two million monthly installs, exhibited two compounding flaws: a “restricted” shell tool allowlist that was not enforced at runtime and an environment-sanitization scheme that left secrets exposed in the parent process via /proc. This combination allowed attackers to escalate from a single anonymous issue to pushing malicious code directly into the main branch. Google rated this vulnerability as CVSS 10.0 in its security advisory and addressed it by implementing a breaking change to its headless execution trust model.
OpenAI’s Codex workflow on its repository ran two agent passes sharing a single workspace. Although OpenAI had protected sensitive directories like .git and .codex from tampering, it overlooked AGENTS.md, the default instruction file the agent loads and trusts on every run. Attackers could poison this file during the first pass, causing the second, “safe” pass to inherit malicious instructions along with any elevated permissions or tokens. OpenAI rectified this issue within three days by isolating the two passes into separate jobs. However, researchers caution that the underlying multi-pass agent pattern remains prevalent elsewhere.
Novee Security emphasizes that these were not simple misconfigurations but rather correct security decisions that failed at the handoff points between different system components. The same vulnerable defaults were found running on more than a hundred public repositories beyond the three vendors tested, indicating that any organization using these coding agents in automation may have inherited the same exposure.
To mitigate these risks, it is recommended to treat every file a workflow writes and every workflow itself as an untrusted input surface, rather than assuming vendor defaults are secure out of the box.
As AI coding agents become increasingly integrated into development workflows, ensuring their security is paramount. Organizations must adopt rigorous security practices, including thorough code reviews, robust input validation, and continuous monitoring, to safeguard against potential exploits that could compromise entire software supply chains.
