Source: The Hacker News — 2026-08-05

Summary

Researchers at Novee Security, presenting at Black Hat USA, showed that a GitHub account with no write access to a repository and no prior relationship with its maintainers could open a single issue and use it to reach CI secrets held by Claude Code, Gemini CLI, and OpenAI Codex — a pattern they call the "Cordyceps" flaws. The Gemini CLI bug, CVE-2026-12537, is an OS command injection reachable via a crafted .gemini/.env file loaded before the sandbox starts, carries a CVSS score of 10.0, and is fixed in version 0.39.1. The Claude Code bug, CVE-2026-54316, abused Hugging Face's public per-repository download counter as a covert side channel to exfiltrate an API key one character at a time, affected every release from 0.2.54 through 2.1.163, and is fixed in 2.1.163. Codex's issue got no CVE because OpenAI considers its sandbox to have behaved as documented, though Novee flagged a workaround-dependent risk in how the sandbox handles a shared workspace across chained runs.

Key Takeaways

• The common root cause across all three tools was the harness layer, not the model: code around the LLM marked an untrusted value as safe at one point and then executed it later without re-checking, letting attacker-controlled issue text reach privileged CI execution.
• CVE-2026-12537 (Gemini CLI, CVSS 10.0): a crafted .gemini/.env file gets loaded and lets an unprivileged attacker run OS commands on the host of a headless CI runner before the sandbox has actually started; fixed in Gemini CLI 0.39.1 and the related run-gemini-cli action in 0.1.22.
• CVE-2026-54316 (Claude Code): an attacker could get Claude Code to create up to 64 Hugging Face model repositories — one per possible character — then read back which repository's public download counter incremented to decode a secret like an API key one character at a time, entirely through a pre-approved WebFetch domain. Every version from 0.2.54 to 2.1.163 was affected; fixed in 2.1.163.
• The OpenAI Codex finding involves a CI pattern where two Codex passes share one checked-out workspace in the same job, and the first pass can write to AGENTS.md, an instruction file Codex loads from disk and treats as authoritative on the next invocation — OpenAI did not assign a CVE, saying the sandbox worked as documented, and instead recommends splitting passes across separate jobs with a read-only, privilege-dropped sandbox.
• The entry point in every case was the same: a public, unauthenticated GitHub issue, meaning an attacker needed zero prior access to the target repository to start the chain.

Reel Script

Hook: An attacker with zero access to your repository — not even permission to comment credibly — could open one GitHub issue and walk out with your CI secrets. Two of the three major AI coding agents had flaws that made this possible, and one of them used a public download counter as a covert data channel.

Core Concept: AI coding agents wired into CI pipelines read GitHub issues as part of their normal job — triaging, summarizing, or acting on them. That means anything in an issue's text is untrusted input flowing straight into a system with access to CI secrets, and the researchers at Novee Security, presenting this pattern as "Cordyceps" at Black Hat, found that all three major agents mishandled that boundary in the harness code around the model, not the model itself. In Gemini CLI, a config file gets loaded and its contents get executed as OS commands before the security sandbox has even started, which is why the flaw scores a perfect 10.0 on the CVSS scale — no privilege required, full host compromise. Claude Code's flaw is subtler and arguably more interesting: since raw network exfiltration gets blocked, the attack instead used Hugging Face's public download counter as a side channel. Every model repository shows the world exactly how many times it's been downloaded, and that number is something an attacker sitting outside your infrastructure can just watch.

Hands-On: Here's the exfiltration mechanism worth drawing out step by step. The attacker sets up 64 public Hugging Face repositories in advance, one assigned to each possible character an API key could contain at a given position. They then plant a prompt injection inside a GitHub issue that Claude Code will read. When the agent processes that issue, the injected instructions get it to make a WebFetch request against the one repository matching the next real character of the secret — because Hugging Face is a pre-approved domain, that request sails through unblocked. Hugging Face logs that request server-side as a "download" and increments that repository's public counter by one. The attacker, watching all 64 counters from outside, sees which one just ticked up, reads off the corresponding character, and repeats — no direct network connection back to the attacker ever happens, so a naive network-egress monitor sees nothing suspicious. On the Gemini CLI side, the parallel artifact is simpler: a crafted .gemini/.env file placed where the CLI auto-loads it, executed as OS commands on the CI host before the sandbox boundary that was supposed to contain it even activates. Both bugs are fixed now — Gemini CLI 0.39.1, Claude Code 2.1.163 — but the affected-version window for Claude Code (0.2.54 through 2.1.163) covers effectively the tool's entire public history until the patch.

Takeaway: The download-counter side channel is the detail worth remembering: it's a reminder that "pre-approved domain" and "safe" are not the same property, and that any service exposing public, attacker-readable metadata is a potential exfiltration channel for an agent with fetch access. If you run any AI coding agent against public-facing repos or issue trackers, update to the patched versions now and audit what your CI-connected agents are allowed to fetch, not just what they can execute.

Discussion