Critical RCE Flaws Found in Anthropic, Google, OpenAI Coding Agents

A chilling reality for anyone running AI coding agents in production: a single anonymous GitHub issue, with zero privileges required, can trigger remote code execution, steal live API keys, and hijack automated pipelines.

The findings, published by Novee Security’s Elad Meged ahead of Black Hat 2026, hit three of the industry’s biggest names, Anthropic, Google, and OpenAI, on their own repositories, running their own default configurations.

The research didn’t rely on misconfigurations or edge cases. Novee tested Anthropic’s Claude Code Action, Google’s Gemini CLI, and OpenAI’s Codex exactly as shipped, on the vendors’ own codebases: anthropics/claude-code, google-gemini/gemini-cli, and openai/codex. In every case, an attacker needed only the ability to open a GitHub issue.

Critical RCE Flaws Found in Anthropic

Claude Code Action went through three rounds of “patch and bypass.” Elad Meged first smuggled a reverse shell past a 23-check command validator by hiding a malicious flag inside single-quote content the security pipeline strips out before scanning.

After Anthropic closed that hole, testers found a hardcoded “read-only” command list that let them read arbitrary files, then exploited a public GitHub Actions log to leak a reversed API key.

The final round used a HuggingFace download counter as a covert side channel to exfiltrate an entire API key one character at a time, ultimately earning CVE-2026-54316.

Google’s Gemini CLI fared worse in severity. A tool-restriction allowlist that looked airtight was never actually enforced at runtime, and an environment “sanitization” layer meant to hide secrets from the agent left them fully readable in the parent process via /proc.

Combined, these two broken assumptions gave an anonymous issue a direct path to pushing malicious code into a repository with roughly two million monthly downstream installs a flaw Google rated CVSS 10.0, the maximum possible score.

OpenAI’s Codex demonstrated a subtler failure: a writable AGENTS.md instruction file, overlooked while other sensitive paths were locked down, let an attacker poison one pass of a multi-agent workflow so its instructions carried into the next, higher-trust pass, effectively hijacking the agent’s future behavior without ever touching a credential directly.

Each flaw traced back to a reasonable security decision that broke down at a handoff point where one part of the system passed an assumption to another that didn’t hold. That’s precisely what makes this dangerous: none of it was negligence, and none of it is confined to three repositories.

Novee says it found the same default configurations running unmodified across more than 100 public repositories, many of which require no human interaction to exploit.

The takeaway for security teams is that deploying an agent means inheriting every undocumented trust decision baked into its harness, the code layer between the model and real-world execution.

Anthropic and Google have shipped fixes, including a breaking change to Gemini CLI’s trust model; OpenAI hardened its own repo within days.

But as Novee notes, patches to vendor repositories don’t automatically patch the copies already running in customer pipelines. For organizations wiring AI coding agents into CI/CD, the message from Black Hat 2026 is clear: audit the harness, not just the model.