AI Coding Agent Trust-Handoff Flaws: CVE-2026-12537 and CI/CD Secret Theft

Seed story: "Same Flaw Found in Claude Code, Codex, Gemini CLI and GitHub Copilot" (The Information) · search original Written from facts verified across 3 report(s) — original explainer, not a copy or translation. Sources at the end.

Security researcher Elad Meged revealed at Black Hat USA that leading AI coding agents—including Claude Code, Gemini CLI, and OpenAI's Codex—share critical trust-handoff vulnerabilities that allow attackers to steal CI/CD secrets. These flaws, such as an OS command injection in Gemini CLI and data exfiltration via Hugging Face in Claude Code, have been patched in recent releases, but developers must verify their local environments are updated to mitigate the risk of agent run hijacking.

The Trust-Handoff Vulnerability Landscape

Elad Meged of Novee Security presented a critical finding at Black Hat USA on August 5, 2026, highlighting a shared architectural flaw across leading AI coding agents. This "trust-handoff" vulnerability exists in the default configurations of Anthropic's Claude Code, Google's Gemini CLI, and OpenAI's Codex. The core issue allows attackers to steal CI/CD secrets by exploiting how these tools process untrusted inputs during automated workflows.

The presentation revealed that these tools often treat repository instruction files or execution environments as trusted, creating a dangerous gap in security. Specifically, the flaws enable:

OS command injection in Gemini CLI.
Data exfiltration via Hugging Face counters in Claude Code.
Agent run hijacking in Codex due to shared workspaces.

For developers, this means that merely installing these agents is no longer sufficient. Teams must audit how their CI/CD pipelines interact with AI tools, ensuring that local environments are hardened against these specific trust-handoff risks before deploying code.

CVE-2026-12537: Gemini CLI Command Injection

CVE-2026-12537 represents a critical failure in Gemini CLI’s container launcher, specifically an OS command injection flaw that allows arbitrary code execution. This vulnerability carries a maximum CVSS 4.0 score of 10.0, reflecting its severe impact on system integrity. Because the flaw resides in the default configuration, any developer using the tool without additional hardening measures is exposed to immediate risk.

The technical mechanism involves the launcher failing to properly sanitize inputs before executing OS-level commands. This oversight permits attackers to inject malicious payloads directly into the execution environment. Such a high severity rating underscores the danger of trusting automated agents with direct system access.

CVSS 10.0: Maximum severity rating for the injection flaw.
Container Launcher: The specific component where the injection occurs.
Default Config: The vulnerability exists out-of-the-box.

Google addressed this critical issue by patching Gemini CLI in versions 0.39.1 and run-gemini-cli 0.1.22. For developers, this highlights the necessity of verifying container isolation and input validation in any AI-driven toolchain. Upgrading to these patched versions is essential to prevent unauthorized command execution and maintain the security of local development environments.

Claude Code Data Exfiltration via Hugging Face

CVE-2026-54316 exposed a subtle but critical data exfiltration vector in Anthropic’s Claude Code. This flaw affected versions 0.2.54 through 2.1.162, allowing attackers to leak sensitive information by leveraging Hugging Face’s public download counter. Because the agent interacts with external model repositories, this trust-handoff gap enabled unauthorized data transmission without explicit user consent.

The impact is significant for developers relying on automated workflows. Key risks include:

Silent exfiltration of environment variables
Compromise of local project secrets
Unintended data leakage during model retrieval

Anthropic addressed this issue in version 2.1.163. For teams using AI agents, this incident underscores the need to audit external network calls. Developers should verify that their agents do not inadvertently transmit local data to third-party services during routine operations.

Codex Agent Run Hijacking and Workspace Isolation

OpenAI’s Codex agent suffered from a distinct architectural flaw: a shared workspace persisted across multiple execution passes. This design allowed a compromised agent to hijack subsequent runs, effectively maintaining a foothold in the development environment. Unlike the command injection or data exfiltration issues seen in other tools, this vulnerability stemmed from the lack of isolation between distinct agent tasks.

To remediate this, OpenAI restructured its workflow to enforce strict boundaries. The key changes include:

Isolating each execution pass into separate jobs.
Flagging repository instruction files as untrusted input.

These measures prevent a single compromised pass from influencing future operations. For developers, this highlights the critical importance of state isolation in agentic pipelines. When integrating AI agents into CI/CD, ensuring that each run starts with a clean, isolated context is now a fundamental security requirement to prevent persistent hijacking.

Patch Status and CISA KEV Implications

Google and Anthropic have released specific updates to address the identified trust-handoff flaws. Google patched the critical command injection vulnerability in Gemini CLI versions 0.39.1 and run-gemini-cli 0.1.22. Meanwhile, Anthropic resolved the data exfiltration issue in Claude Code version 2.1.163, covering the previously affected range from 0.2.54 to 2.1.162. OpenAI, which did not assign a separate CVE for its workspace isolation flaw, restructured its workflow to isolate execution passes and flag repository instruction files as untrusted input.

Despite the severity of these issues, neither CVE-2026-12537 nor CVE-2026-54316 appears in the CISA Known Exploited Vulnerabilities catalog as of August 7, 2026. This absence suggests that, according to reports, active exploitation in the wild has not yet been confirmed or widely documented. For developers, this status implies a critical window of opportunity. While the lack of KEV listing may reduce immediate panic, it does not mitigate the risk. Teams should prioritize applying these patches immediately, as the vulnerabilities exploit default configurations that many organizations rely on for automated CI/CD pipelines.

Hardening Local Environments Against Agent Flaws

Developers can mitigate these trust-handoff risks by treating repository instruction files as untrusted input. As OpenAI demonstrated when restructuring its workflow, explicitly flagging these files prevents agents from executing malicious directives hidden in codebases. This approach is critical because default configurations in tools like Claude Code and Gemini CLI previously allowed attackers to steal CI/CD secrets without explicit user consent.

To further secure your workflow, consider the following practical steps:

Isolate execution contexts to prevent shared workspace vulnerabilities, similar to OpenAI’s fix for Codex.
Audit and restrict permissions granted to AI agents within your CI/CD pipelines.
Verify that your local agent versions include recent patches, such as Gemini CLI 0.39.1 or Claude Code 2.1.163.

By implementing these controls, teams can reduce the attack surface exposed by AI coding assistants.

FAQ

How do I fix the CVE-2026-12537 vulnerability in Gemini CLI?

You should update Gemini CLI to version 0.39.1 or run-gemini-cli to version 0.1.22 to patch the OS command injection flaw. This update addresses the container launcher vulnerability that carried a maximum CVSS 4 score of 10.0.

Which version of Claude Code resolves the data exfiltration issue tracked as CVE-2026-54316?

Anthropic patched this vulnerability in Claude Code version 2.1.163. The flaw affected versions 0.2.54 through 2.1.162 and allowed data exfiltration via Hugging Face's public download counter.

How did OpenAI address the security flaw in Codex without assigning a specific CVE?

OpenAI restructured its workflow to isolate Codex execution passes into different jobs to prevent agent run hijacking. Additionally, the company now flags repository instruction files as untrusted input to mitigate shared workspace risks.