A repeatable vulnerability pattern across AI coding agents from Anthropic, Google, and OpenAI that allows attackers to achieve remote code execution, steal API credentials, and compromise software supply chains, all without any privileged access.
The flaws were discovered by Novee security Researcher Elad Meged testing each vendor’s default configuration on their own public repositories, meaning the exposure isn’t theoretical; it’s live on the exact code millions of developers run today.
The core issue lies not in the AI models themselves but in the “harness,” the surrounding code that manages tool permissions, execution, and sandboxing around each agent.
Researcher Elad Meged found that a single GitHub issue, opened by an anonymous stranger with zero privileges, was enough to trigger the agent and smuggle in prompt-injection payloads that the harness failed to properly contain.
Because these agents often run autonomously in CI/CD pipelines with no human reviewing every action, a malicious instruction hidden in an issue or pull request can travel straight through to code execution .
Anthropic’s Claude Code Patch and Bypass
On Anthropic’s own claude-code repository, researchers achieved remote code execution by exploiting a mismatch between Claude’s command validation logic and how the shell actually interprets quoted strings, allowing a malicious git push –receive-pack flag to bypass twenty-three security checks and execute arbitrary code on the runner.
After Anthropic patched the flaw, researchers found a second bypass using the read-only command tac to read arbitrary files, including exfiltrating a reversed API key through a public GitHub Actions log .
A third round used HuggingFace’s public download counter as a covert side channel to leak an API key one character at a time, ultimately assigned CVE-2026-54316.
Google’s Gemini CLI Supply Chain Risk
Google’s Gemini CLI, running on a repository with over 106,000 stars and roughly two million monthly installs, suffered from two compounding flaws: a “restricted” shell tool allowlist that was never actually enforced at runtime, and an environment-sanitization scheme that cleaned secrets from the child process while leaving them fully exposed in the parent process via /proc.
Combining full shell access with easily readable credentials let attackers escalate from a single anonymous issue to pushing malicious code directly into the main branch, a compromise Google rated CVSS 10.0 in its own security advisory and addressed with a breaking change to its headless execution trust model .
OpenAI’s Codex Persistent Hijack
OpenAI’s Codex workflow on its own repository ran two agent passes sharing a single workspace, and while OpenAI had already protected sensitive directories like .git and .codex from tampering, it overlooked AGENTS.md, the default instruction file the agent loads and trusts on every run.
Attackers could poison this file during the first pass so that the second, “safe” pass inherited malicious instructions, along with whatever elevated permissions or tokens it carried.
OpenAI fixed its own repository within three days by separating the two passes into isolated jobs, but researchers warn that the underlying multi-pass agent pattern is still widely copied elsewhere.
Novee Security emphasizes that none of these were simple misconfigurations, they were correct security decisions that broke down at handoff points between different parts of each system.
The same vulnerable defaults were found running on more than a hundred public repositories beyond the three vendors tested, meaning any organization running these coding agents in automation likely inherited the same exposure.
The researchers recommend treating every file a workflow writes, and every workflow itself, as an untrusted input surface rather than assuming vendor defaults are safe out of the box.
Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.
The post Critical Flaws in Anthropic, Google, and OpenAI’s Coding Agents Enable RCE and Supply Chain Attacks appeared first on Cyber Security News.
