[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fbi04JibciAkZRMsrIy9_crlOcieyJi4Kih6vx_txovo":3},{"article":4,"iocs":54,"watch_terms":62,"solutions":63,"lesson":155},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"645cac75-53af-4418-b80d-067260de935a","Claude Code and Gemini CLI Flaws Let a GitHub Issue Reach CI Workflow Secrets","claude-code-and-gemini-cli-flaws-let-a-github-issue-reach-ci-workflow-secrets-8eab46","A GitHub issue opened by an account with no repository privileges was enough to execute code on the CI runners behind Anthropic's and Google's own coding-agent repositories. On OpenAI's, it was enough to hijack the next agent run. Novee Security ran the attack against each vendor's agent in the configuration that the vendor ships by default, and presented the work at Black Hat USA on August 5.","Novee Security discovered vulnerabilities in Anthropic's Claude Code and Google's Gemini CLI that allowed unprivileged attackers to execute code on CI runners. The flaws, disclosed at Black Hat USA, led to two CVEs: CVE-2026-12537 for Gemini CLI (CVSS 10.0) and CVE-2026-54316 for Claude Code. OpenAI's Codex also had a vulnerability allowing workflow hijacking. All critical issues have been patched.","Claude Code and Gemini CLI flaws allowed GitHub issues to execute code on CI runners.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fclaude-code-and-gemini-cli-flaws-let.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEguukj-eRhx9RtAq9X96hAxHi0IU3ZWgM_W5XkdWhF8ezevuBQygkpv-ku5PSri9Gt5hRkNVxe6HmJJr5Mg33X_PhOGziqaho9bwm-mkRZSBl2jo94XF3jRwTZOb_PocueKWJkEtvl7kG_YqmbVfUxNht8_ODzLOERIqQteMdPxnWpobM-c9-fHhn0cLMQ\u002Fs1600\u002Fclaude-github.jpg","2026-08-07T08:18:35+00:00","2026-08-07T10:00:19.083668+00:00",9,[17,20,22,24,27,29],{"name":18,"type":19},"Claude Code","product",{"name":21,"type":19},"Gemini CLI",{"name":23,"type":19},"Codex",{"name":25,"type":26},"Anthropic","vendor",{"name":28,"type":26},"Google",{"name":30,"type":26},"OpenAI","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,44,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59],{"type":56,"value":57,"context":58},"cve","CVE-2026-12537","OS command injection in Gemini CLI container launcher",{"type":56,"value":60,"context":61},"CVE-2026-54316","API key exfiltration channel in Claude Code via Hugging Face download counter",[28,25,30],{"controls":64,"vendors":149},[65,94,123],{"slug":66,"name":67,"problem":68,"products":69},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[70,78,86],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"slug":95,"name":96,"problem":97,"products":98},"patch-management","Automated patch management","Known holes get closed in days, not months.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":124,"name":125,"problem":126,"products":127},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[128,133,141],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":129,"product_name":130,"url":131,"description":132},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",[150],{"slug":151,"name":28,"logo_path":152,"roles":153},"google","\u002Fvendor-logos\u002Fgoogle.png",[154],"affected",{"slug":156,"title":157,"body":158,"framework_refs":159,"framework_notes":172},"ai-cli-tools-exposed-cicd-secrets-via-code-execution-flaws","AI CLI Tools Exposed CI\u002FCD Secrets via Code Execution Flaws","Vulnerabilities in widely adopted AI developer tools — Claude Code, Gemini CLI, and OpenAI Codex — allowed attackers to escalate from a simple GitHub issue submission to full code execution on CI runners, potentially exfiltrating workflow secrets and environment variables. The root cause lies in insufficient input sanitization and trust boundary enforcement within tools that are deeply integrated into software supply chains. Because these CLI agents operate with elevated privileges in automated pipelines, a single exploitable flaw can compromise entire build and deployment environments. This matters because AI coding assistants are rapidly becoming critical infrastructure in development workflows, yet their security posture often lags behind their adoption rate.",[160,161,162,163,164,165,166,167,168,169,170,171],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 16: Application Software Security","NIST SP 800-218 (SSDF) PW.4: Reuse Existing, Well-Secured Software","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 SA-15: Development Process, Standards, and Tools","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 AU-12: Audit Record Generation","NIST CSF DE.CM-8: Vulnerability Scans","SLSA Supply Chain Levels for Software Artifacts — Level 2+ (hosted source & build)","OWASP Top 10 CI\u002FCD Security Risks: CICD-SEC-6 (Insufficient Credential Hygiene)","OWASP Top 10 CI\u002FCD Security Risks: CICD-SEC-9 (Improper Artifact Integrity Validation)",{}]