What Happened
Novee Security disclosed two vulnerabilities in AI coding agent pipelines at Black Hat USA on August 5, demonstrating how a GitHub issue opened by an account with zero repository privileges executes code on the continuous integration runners behind Anthropic’s, Google’s, and OpenAI’s own repositories. The research covered default vendor-shipped configurations and demonstrated how an outside actor — no pull request, no merge, no code review required — reaches secrets stored in CI environments.
Two CVEs resulted. CVE-2026-54316 affects Claude Code versions 0.2.54 through 2.1.162. The flaw turned Hugging Face’s public download counter into an exfiltration channel, leaking an API key one character at a time by encoding each character as a view count increment. Anthropic patched the issue in Claude Code 2.1.163. CVE-2026-12537 carries a CVSS 4 score of 10.0 and affects Gemini CLI versions prior to 0.39.1. It is an OS command injection flaw in the container launcher, reachable through a crafted .gemini/.env file in a repository, and allows an unprivileged attacker to run arbitrary commands on the host of a headless CI platform before the sandbox environment starts. Google patched it in Gemini CLI 0.39.1 and run-gemini-cli 0.1.22. The OpenAI Codex pipeline was also vulnerable to agent run hijacking, though no separate CVE was assigned. Neither Claude Code nor Gemini CLI CVE appears in CISA’s Known Exploited Vulnerabilities catalog as of August 7.
Why This Matters for Canadian Organizations
Canadian development teams, managed security service providers, and software companies using AI coding agents in their CI/CD pipelines face a concrete supply chain risk. AI coding agents operate with elevated trust in development environments — they read code, write code, and access repository secrets including API keys, cloud credentials, and signing certificates. The CVE-2026-54316 and CVE-2026-12537 findings show attackers do not need to compromise the developer’s machine or the repository itself. A crafted GitHub issue, opened from a throwaway account with no privileges, is sufficient to reach the CI runner and everything it has access to.
For Canadian organisations with OSFI B-13 obligations, AI coding agents integrated into software delivery pipelines qualify as third-party technology risks requiring assessment. The Novee Security research demonstrates default agent configurations at three major vendors were exploitable — teams should not assume vendor defaults are secure. Under PIPEDA, any breach of developer credentials resulting in unauthorized access to personal information in a repository or cloud environment triggers mandatory breach reporting to the Office of the Privacy Commissioner.
What to Do
Update Claude Code to 2.1.163 or later and Gemini CLI to 0.39.1 or later immediately. Audit CI/CD pipeline configurations to confirm AI coding agents run with the minimum necessary permissions — remove write tokens from pull-request triggered jobs unless strictly required. Rotate any API keys, cloud credentials, or secrets accessible to CI runners where these tools were deployed before patching. Review GitHub Actions workflow files for pull_request_target triggers exposing privileged contexts to untrusted code. Treat AI coding agent access to secrets stores with the same rigour applied to human developer access: short-lived credentials, scoped permissions, and audit logging on every secret retrieval. Security teams should monitor for unexpected outbound connections from CI runners, particularly to counter, view, or analytics endpoints, as CVE-2026-54316 shows data exfiltration need not use traditional channels.
Source: The Hacker News
