Security researchers have disclosed critical vulnerabilities affecting AI coding agents from Anthropic, Google, and OpenAI, demonstrating how attackers could compromise automated development workflows through a single untrusted GitHub issue.
According to the research presented by Novee at Black Hat USA 2026, the flaws were found in the vendors’ own repositories running their default configurations.
This suggests that organizations using similar AI agent automations could face comparable risks.
Key takeaways
- Researchers found critical flaws in Anthropic, Google, and OpenAI AI coding agents that could enable attacks through a single malicious GitHub issue.
- The vulnerabilities affected AI agent workflows, enabling remote code execution, credential theft, and supply chain compromise.
- All three vendors released mitigations, but organizations using similar default configurations may still be at risk.
- Organizations should harden AI agent workflows with least privilege, isolated execution, and continuous monitoring.
AI coding agent vulnerabilities at a glance
| Vendor | AI Coding Agent | Primary Risk Demonstrated | Vendor Response |
| Anthropic | Claude Code | Prompt injection leading to remote code execution and credential theft | Released multiple patches and assigned CVE-2026-54316 |
| Gemini CLI | Bypass of execution restrictions resulting in credential theft and potential supply chain compromise | Rated CVSS 10.0 and changed its trust model for non-interactive environments | |
| OpenAI | Codex | Persistent prompt injection through writable AGENTS.md workflow files | Hardened repository workflows and documented AGENTS.md as an untrusted input |
Researchers identify a common attack pattern
Rather than exploiting model behavior alone, the researchers found a repeatable weakness in the software harnesses surrounding AI agents.
These harnesses manage tool access, permissions, execution, memory, and workflow orchestration, making them a critical part of an organization’s attack surface.
The researchers demonstrated:
- Remote code execution (RCE) on vendor-managed runners.
- Theft of API keys, GitHub tokens, and other credentials.
- Software supply chain compromise affecting downstream users.
- Persistent agent hijacking through writable workflow files.
The researchers emphasized that the issue was not limited to the tested repositories.
Because the vendors shipped similar default configurations, organizations using these coding agents in automated workflows could inherit the same exposure.
Default workflows enabled compromise
The research examined Anthropic’s Claude Code, Google’s Gemini CLI, and OpenAI’s Codex running within each vendor’s own GitHub repositories.
For Anthropic, researchers showed how a prompt injection delivered through a GitHub issue led to remote code execution, allowing attackers to read arbitrary files and steal GitHub and Anthropic API credentials.
Anthropic issued multiple patches throughout the disclosure process before ultimately assigning CVE-2026-54316.
Google’s Gemini CLI research demonstrated that assumptions around restricted shell commands and environment isolation could be bypassed.
The resulting attack chain enabled credential theft and could ultimately lead to software supply chain compromise.
Google rated the issue as CVSS 10.0 and introduced a breaking change to its trust model for non-interactive execution environments.
For OpenAI’s Codex, researchers found that a writable AGENTS.md file could persist attacker-controlled instructions across multiple automated workflow stages.
Although OpenAI hardened its own repository by separating workflow stages and documenting the file as an untrusted input surface, the researchers warned that organizations using similar multi-pass workflows may still be vulnerable.
Organizations should evaluate AI agent workflows
The researchers concluded that the vulnerabilities stemmed from hidden trust assumptions within AI agent harnesses rather than isolated implementation mistakes.
Organizations deploying AI coding agents should:
- Review AI agent workflows for untrusted inputs that can influence automated actions.
- Restrict permissions granted to AI agents using least-privilege principles.
- Isolate workflow stages and avoid sharing writable workspaces between agent executions.
- Treat workflow-generated files as untrusted inputs unless explicitly validated.
- Continuously validate AI agent behavior as software, dependencies, and default configurations change.
- Monitor AI-powered CI/CD pipelines for unauthorized execution, credential access, and workflow modifications.
- Test incident response plans for AI agent and software supply chain compromise scenarios.
AI agent security extends beyond the model
The research illustrates that securing AI agents requires protecting the surrounding automation infrastructure as much as the underlying model.
As organizations increasingly embed AI into development and operational workflows, strong governance over agent permissions, execution environments, and trust boundaries will be essential to reduce enterprise risk.