Black Hat: One Malicious GitHub Issue Yields RCE and Credential Theft in Claude Code, Gemini CLI, and Codex Workflows (CVE-2026-54316)

The default agentic CI/CD workflows shipped by Anthropic (Claude Code), Google (Gemini CLI), and OpenAI (Codex), found in each vendor's own repositories running their own default configurations

Novee Security presented findings at Black Hat USA 2026 showing that an unauthenticated attacker who can file a GitHub issue or open a pull request can reach remote code execution on vendor-managed runners, steal API keys and GitHub tokens, and stage a software supply chain compromise. Against Claude Code, prompt injection delivered through a GitHub issue produced remote code execution allowing arbitrary file reads and theft of GitHub and Anthropic API credentials; Anthropic shipped multiple patches across the disclosure window and ultimately assigned CVE-2026-54316. Against Gemini CLI, the researchers bypassed the assumed guarantees of restricted shell commands and environment isolation, chaining to credential theft and downstream supply chain compromise; Google rated the issue CVSS 10.0 and introduced a breaking change to its trust model for non-interactive execution. Against Codex, attacker-controlled instructions written into a writable `AGENTS.md` persisted across multiple stages of an automated workflow; OpenAI separated the workflow stages and documented `AGENTS.md` as an untrusted input surface

The flaws sit in the harness rather than the model: the surrounding code that manages tool permissions, execution, and sandboxing around each agent. Each vendor's reference workflow granted a publicly triggerable agent the credentials of a trusted maintainer, so anyone able to post text into the repository could steer privileged automation