ChainDrop: When Opening a Repository Becomes Execution

Summary

Novee Security disclosed a set of vulnerabilities in the CI/CD harnesses of three major coding agents — Anthropic's Claude Code, Google's Gemini CLI, and OpenAI's Codex — showing that a GitHub issue filed by an account with no repository privileges could reach CI runner secrets or hijack a subsequent agent run. The research was presented at Black Hat USA on August 5, 2026, and produced two patched CVEs.^[0]

The recurring failure was in the harness — the code around the model that decides what actually runs — where one component marked a value safe and a later component acted on it with more authority. The most severe issue, CVE-2026-12537 in Gemini CLI (CVSS v4 10.0), is an OS command injection reached through a crafted .gemini/.env file, and did not require manipulating the model at all. Claude Code's CVE-2026-54316 leaked an API key through Hugging Face's public download counter. The Codex finding yielded no CVE and no product patch.^[0][15][11]

All affected components are patched or addressed at the repository/workflow level. As of August 7, 2026 neither CVE was listed in CISA's Known Exploited Vulnerabilities catalog, and the sources reviewed show no evidence of either chain being used against a target, positioning this as vulnerability research rather than observed exploitation.^[0][11][15]

Attack chain

1. Initial access via untrusted input: An external account with no repository privileges opens a GitHub issue whose content is ingested into the coding agent's CI workflow, injecting attacker-controlled content into the agent's context.^[0]
2. Harness trust confusion: A harness component marks the attacker-supplied value as safe while a later component acts on it with greater authority — for example Claude Code's command validator strips single-quoted text before its 23 checks run, so a payload placed in the value of git push --receive-pack reached the runner untouched.^[0]
3. Code execution / secret access: On Gemini CLI, a crafted .gemini/.env file drives OS command injection in the container launcher, running code on the CI host before the sandbox starts. On Claude Code, the flaw exfiltrated an API key one character at a time using Hugging Face's public download counter as a covert channel.^[0]
4. Agent-run hijack (Codex): In the openai/codex repository two Codex passes shared one checkout in a single job; failing JSON validation between passes launched a second pass that loaded an AGENTS.md file written by the first pass as its own instructions.^[0]

Disclosure timeline

How it works

CVE-2026-12537 (Gemini CLI) is an OS command injection in the container launcher reached through a crafted .gemini/.env file, allowing an unprivileged attacker to run code on the host of a headless CI platform before the sandbox starts; it did not require talking the model into anything.^[0][15]

Gemini CLI also parsed its tool allowlist only when registering the tool, with nothing enforcing it at runtime, and under the --yolo flag every command the model requested was auto-approved.^[0]

CVE-2026-54316 (Claude Code) used Hugging Face's public download counter as an exfiltration channel, leaking an API key one character at a time; Anthropic says exploitation required getting untrusted content into a Claude Code context.^[0][11]

Claude Code's command validator strips single-quoted text before its 23 validation checks run — correct bash behavior — so a payload placed in the value of the git push --receive-pack flag, which git executes, reached the runner untouched. This chain has no CVE and no publicly stated fixed version.^[0]

The Codex finding relied on the openai/codex repository running two Codex passes inside one job sharing a single checkout, so the first pass could write AGENTS.md, which the second pass loads as its own instructions; failing the JSON validation between passes is what launched the second pass.^[0]

Affected versions and patch status

Key takeaways

• The vulnerabilities lived in the harness — the code between the model and the real world — not in the models themselves; a component marking a value safe while a later component acted on it with more authority was the recurring pattern across all three vendors.^[0]
• The most severe flaw, Gemini CLI's CVSS 10.0 CVE-2026-12537, required no model manipulation at all, underscoring that CI harness code paths are exploitable independent of prompt-injection concerns.^[0][15]
• Scoring divergence matters: Anthropic rated the Claude Code flaw Moderate (CVSS v4 6.0) while NVD scored it 9.1 under v3.1, and the two are not a like-for-like comparison since NVD has not scored it under v4.^[0][11]
• Despite a public reproduction repository since June 18, the sources reviewed show no in-the-wild use of either chain, and neither CVE was in CISA's KEV catalog as of August 7, 2026.^[0]

Defensive actions

• Update Gemini CLI to 0.39.1, run-gemini-cli to 0.1.22, and Claude Code to 2.1.163.: These are the fixed versions that remediate the patched CVEs (CVE-2026-12537 and CVE-2026-54316).^[0][9][10]
• Audit any workflow that an outside user can trigger.: The attacks began with a GitHub issue from an account with no repository privileges reaching CI workflows, so externally triggerable workflows are the exposed surface.^[0]
• Treat repository instruction files (e.g. AGENTS.md) as part of the untrusted input surface and run coding agents as the last step in a job.: OpenAI's updated guidance warns that a coding agent may otherwise leave files behind for privileged steps that follow, as demonstrated by the Codex two-pass finding.^[0][14]