Security researchers from Novee Security demonstrated at Black Hat USA (August 5, 2026) how vulnerabilities in two widely used AI coding assistants — Anthropic’s Claude Code and Google’s Gemini CLI — can be weaponized so that a crafted GitHub issue silently steals secrets from CI/CD pipelines. Neither attack requires manipulating the AI model itself; both exploit implementation flaws that are present in the tools’ default configurations.
The Claude Code flaw (CVE-2026-54316, CVSS 9.1 under v3.1) involves the tool’s command validator stripping single-quoted text before running security checks. This allows a payload embedded in a git flag to pass through validation undetected. Researchers also discovered a side-channel technique: they weaponized Hugging Face’s public download counter to exfiltrate API keys one character at a time — no direct outbound connection from the CI host required. The Gemini CLI vulnerability (CVE-2026-12537, CVSS 10.0) is an OS command injection flaw triggered by a crafted .gemini/.env file; it executes attacker code on the CI host before the sandbox even starts, making sandbox isolation irrelevant. Researchers also noted an OpenAI Codex behavior where two passes within a single CI job shared the same repository checkout, letting the first pass plant instructions that the second pass would follow — though OpenAI did not assign a CVE and framed this as a workflow configuration issue rather than a bug.
How to check if you’re affected
Affected versions of Claude Code are 0.2.54 through 2.1.163; the patched version is 2.1.163. Run claude --version to check. Affected versions of Gemini CLI are any release before 0.39.1; gemini --version shows your current version. The patched releases are Gemini CLI 0.39.1 and run-gemini-cli 0.1.22. Update both tools immediately if you use them in any CI pipeline that has access to secrets, API keys, or deployment credentials. After patching, audit your CI logs for unexpected outbound requests or unusual command execution during recent runs.