Critical Flaws in AI Coding Agents Allow RCE and Supply Chain Attacks
Researchers found critical vulnerabilities in AI coding agents from Anthropic, Google, and OpenAI, enabling remote code execution and supply chain compromises.
Researchers have uncovered a pattern of critical vulnerabilities affecting AI coding agents from major providers including Anthropic, Google, and OpenAI. These flaws allow attackers to achieve remote code execution (RCE), steal sensitive API credentials, and compromise software supply chains, all without requiring any elevated privileges.
The core of the issue lies not within the AI models themselves, but in the surrounding "harness" code responsible for managing tool permissions, execution environments, and sandboxing. Novee security researcher Elad Meged demonstrated that a single, unprivileged GitHub issue could be used to inject prompt-injection payloads that the harness failed to properly contain. This is particularly concerning as these agents often operate autonomously within CI/CD pipelines, where malicious instructions can bypass human oversight and directly lead to code execution.
On Anthropic's Claude Code Patch repository, researchers exploited a mismatch in command validation and shell interpretation to achieve RCE. A malicious git push --receive-pack command bypassed numerous security checks, executing arbitrary code. Even after Anthropic patched this, a second bypass was found using the tac command to read arbitrary files, including exfiltrating an API key via GitHub Actions logs. A third method used HuggingFace's download counter as a covert channel to leak API keys, leading to the assignment of CVE-2026-54316.
Google's Gemini CLI faced similar risks. A flawed "restricted" shell tool allowlist that was not enforced at runtime, combined with secrets exposed in the parent process via /proc while being sanitized in the child process, allowed attackers to escalate from an anonymous issue to pushing malicious code directly into the main branch. Google itself rated this vulnerability a CVSS 10.0 and implemented a breaking change to its headless execution trust model.
OpenAI's Codex workflow on its own repository suffered from a vulnerability where the agent's default instruction file, AGENTS.md, could be poisoned during an initial pass. The subsequent, supposedly "safe" pass would then inherit malicious instructions and any associated elevated permissions or tokens. OpenAI addressed this by isolating agent passes into separate jobs, a pattern researchers note is still widely replicated.
Novee Security emphasizes that these were not simple misconfigurations but breakdowns at critical handoff points between system components. The same vulnerable default configurations were found on over a hundred public repositories beyond the three vendors tested, indicating a widespread potential exposure for organizations utilizing these coding agents in their automation workflows.
The researchers strongly advise treating every file written by a workflow, and the workflow itself, as an untrusted input. Organizations should avoid assuming vendor defaults are secure out-of-the-box and implement stricter validation and isolation mechanisms for AI agent operations.