Black Hat 2026: researchers break Claude Code, Gemini CLI and Codex via trust handoffs

A Black Hat USA 2026 briefing from Novee Security, "Trusted Enough to Run: Breaking AI Agents in Official Workflows," documented three exploitable vulnerabilities in three widely used AI coding agents. According to a dev.to writeup reviewing the technical disclosures, each flaw lived in the agent's own repository, and in two cases the trigger was simply the code the agent had been asked to review.

Claude Code: a validator blinded by its own preprocessing

The writeup reports CVE-2026-54316 (CVSS v4 score 6.0), affecting Claude Code versions 0.2.54 up to but not including 2.1.163. The command validator ran 23 security checks on every command before execution, but a preprocessing step stripped single-quoted text from the command string first — so anything inside single quotes was invisible to all 23 checks. An attacker could wrap a shell command substitution in single quotes inside a git push command: the validator saw a plain push, while the shell parsed and executed the substitution.

Anthropic patched the bug, and Novee Security then found two bypasses, per the writeup. The first used tac — the reverse of cat, which stayed blocked — to read arbitrary files and exfiltrate their contents through a public GitHub Actions log, reversing an API key before writing it so log scanners would not flag it, then reversing it back after reading. The second turned HuggingFace's public download counter into a covert channel: data was encoded in the number of downloads the agent triggered and read back from a separate request, with no exfiltration channel, DNS or HTTP callback involved. Both bypasses worked because the patch removed the quote-stripping step but kept the architecture: the validator still inspected a sanitized representation of the command, not the bytes the shell would execute.

Gemini CLI: an auto-trusted .env file before the sandbox

Gemini CLI's CVE-2026-12537 (GHSA-wpqr-6v78-jr5g) carries a maximum CVSS v3.1 score of 10.0. At disclosure the project reportedly had more than 106,000 stars and around 2 million monthly installs. In headless CI mode, the CLI automatically loaded .gemini/.env from the checked-out repository and trusted its contents before the sandbox started, so a malicious file could set environment variables steering the agent's behavior — including injected API endpoints and credentials — outside any security boundary. Separately, the --yolo flag's command allowlist was parsed but never enforced, meaning commands that merely resembled allowlisted ones ran without approval, and inside the sandbox the agent could read /proc to reach the parent process's environment and its secrets. Google classified the issue as a supply chain compromise; fixes landed in Gemini CLI 0.39.1 and 0.40.0-preview.3 and in run-gemini-cli 0.1.22, with Dan Lisichkin of Pillar Security credited as co-discoverer.

Codex: trusting an AGENTS.md written moments earlier

The OpenAI Codex case has no CVE, but the writeup calls it in some ways the most revealing. Codex's CI pattern runs two steps that share a working directory: the first writes AGENTS.md into the repository, and the second checks out the same repo and loads that file as instructions, trusting it because it exists on disk — even though OpenAI's own documentation classifies AGENTS.md as untrusted input. The fix took three days: isolate the jobs so they no longer share a checkout. Novee Security reportedly found the same multi-pass pattern, one agent writing configuration a second agent then reads, in over 100 public repositories.

The common failure: trust handoffs

Elad Meged of Novee Security describes the harness — "the code between the model and the real world" — as where all three bugs live. Each is a failed trust handoff: Claude Code's validator trusted that the string it inspected was the string the shell would execute; Gemini CLI trusted repository-provided .env content before the sandbox existed; Codex's second step trusted that an on-disk file predated the job.

The writeup's central argument is that detection cannot settle these incidents after the fact. Logs can be tampered with, timestamps spoofed, and a process with arbitrary code execution can rewrite its own audit trail. Detection may show that something might have gone wrong, but it cannot prove that the validator's sanitized view diverged from the shell's parsed view, or which .env values loaded before the sandbox started.

The proposed remedy is cryptographic evidence: signed receipt chains recording exactly what crossed each trust boundary and what the receiving side did with it. A validator would sign the bytes it evaluated and the checks that passed; an executor would sign the bytes it received; a mismatch becomes provable rather than merely detectable. The dev.to author maintains an ELv2-licensed tool for verifying such chains, ccs-verifier, alongside an MIT-licensed conformance vector suite defining valid receipt chains for common agent operations.

Why it matters

AI coding agents now sit inside official CI workflows with access to repository contents, credentials and secrets. None of these flaws were in the models — they were in the ordinary harness code around them, the same class of code many teams are shipping today. The immediate actions are concrete: upgrade Claude Code to 2.1.163 or later and Gemini CLI to 0.39.1 or later, and audit pipelines for the shared-checkout, multi-pass pattern Codex used. The longer-term lesson is harder: harnesses that are trusted enough to run need provable evidence at every handoff, not just logs that say nothing went wrong.