← News
/DISPATCH · 2026-08-20

Black Hat USA 2026: CVE-2026-54316 Claude Code and CVE-2026-12537 Gemini CLI One-Click RCE via GitHub Issue, CVSS 10.0

Novee Security at Black Hat USA 2026: paste a prompt-injection payload into any GitHub repo's public Issues and compromise Claude Code (CVE-2026-54316), Gemini CLI (CVE-2026-12537, CVSS v4.0 10.0), and OpenAI Codex—exfil CI credentials plus ANTHROPIC/GITHUB tokens. Force-upgrade Gemini CLI 0.39.1 and Claude Code 2.1.163.

At Black Hat USA 2026, Novee Security researcher Elad Meged disclosed an attack chain where any passerby posting one GitHub Issue can steal CI credentials. The same prompt-injection payload hits Anthropic Claude Code (CVE-2026-54316), Google Gemini CLI (CVE-2026-12537, CVSS v4.0 10.0), and OpenAI Codex. Claude Code shipped a fix in 2.1.163; Gemini CLI in 0.39.1 and run-gemini-cli 0.1.22. OpenAI issued no patch and called the sandbox behavior-by-design. Novee Security and contemporaneous reports put H2 2026 AI coding-agent CI/CD credential exfil on the table: if GitHub Actions, GitLab CI, Bitrise, and similar pipelines still trust AI agents as automated maintainers, the entire pipeline becomes a data-exfil window.

Incident Overview

Black Hat USA 2026 main track ran 5–6 August at Mandalay Bay, Las Vegas. Researcher Elad Meged demoed the full chain in the session AI Coding Agent RCE via GitHub Issue: any logged-in user opens a Public Issue on the target GitHub repo and pastes a crafted prompt-injection payload. CI pipelines with Issue-handling automation and AI coding agents feed that Issue body to the agent. The agent, using built-in tool privileges and write access to the repo, incrementally exfils the CI `GITHUB_TOKEN` and `ANTHROPIC_API_KEY` via seemingly normal Git and Hugging Face model-download requests. Anthropic and Google shipped patches and verification steps in early-August changelogs. OpenAI Codex was officially classified as sandbox behavior matching design.

Meged's attack has two key amplifier paths. First, Claude Code Action label mode decomposes `git push` into steps and accepts Git arguments; the attacker uses a flag that looks compliant to step validation but has side effects in Git, causing the command to run outside the sandbox and read secrets from `env`. Second, Gemini CLI before 0.39.1 auto-trusts `.gemini/.env` and the workspace directory, loading those configs even before sandbox start; the attacker either lands a malicious `.env` via PR or, as here, piggybacks Issue-side-channel CI credential theft. Both products hide outbound data in Hugging Face model-download counters—a legitimate, public, encodable channel—so traffic audit, SIEM, and traditional DLP almost never see it. CSA and Dark Reading's 18 August recap listed the mid-July Hugging Face–OpenAI privilege escalation and this GitHub Issue attack as twin milestones of AI agents moving from curiosity to production risk.

Technical Details

Impact Assessment

For the supply chain, CVE-2026-54316 and CVE-2026-12537 are typical breadth-class bugs: a single Public Issue is enough. The attack no longer depends on a project-owned vuln; it rides the design assumption that AI agents are collaboration partners. ByteIota and ZeroDay News both stress the lesson is not model runaway but harness (scaffolding) runaway—most teams hand-assemble the agent's runtime context in GitHub Actions YAML and shell scripts, with no privilege boundary and no zero-trust evaluation.

CSA's 18 August Hugging Face post-assessment offered three recommendations: (1) identify high-risk AI agents (unnecessary privileges, write access to the main repo) and immediately revoke write roles; (2) this month, deploy continuous monitoring of agent behavior in CI (anomalous external API calls, token writes, sensitive-field leaks) plus IR playbooks; (3) this quarter, assign an owner for AI systems and run tabletop exercises plus deception-system deployment. Those recommendations apply directly to CVE-2026-54316/12537 governance: grade agents by capability, move tokens from agent-reachable env into an out-of-agent trusted proxy, minimize token scope. The two CVEs plus the Hugging Face post-assessment jointly signal that the AI supply chain has shifted from model-weight trust to agent-runtime trust.

Remediation

References