"The harness is the code between the model and the real world," Novee founding engineer Elad Meged wrote.
Two CVEs, three vendors, one recurring harness failure
Security researcher Novee Security demonstrated at Black Hat USA on August 5 that a low-privilege GitHub issue could, in default product configurations, execute code or otherwise cross privilege boundaries in three widely distributed coding-agent repositories. The work produced two tracked CVEs — both of which have published fixes — and one additional finding that yielded workflow changes rather than a versioned patch.
The two tracked advisories are CVE-2026-12537 (Gemini CLI) and CVE-2026-54316 (Claude Code). Novee reported the problems after running the attack against each vendor's shipped defaults. Novee and the vendors agree the recurring root cause sat not in the models but in the harness: the surrounding code that evaluates and enforces what the model may request and what the runtime actually executes.
Gemini CLI: host command injection and tool allowlist bypass (CVE-2026-12537)
Gemini CLI carried the more severe of the two tracked flaws. CVE-2026-12537 (CVSS 4 score: 10.0) is an OS command injection in the container launcher reached through a crafted .gemini/.env file, allowing an unprivileged attacker to run code on the host of a headless CI platform before the sandbox starts. Google addressed the container-launcher bug and a separate runtime enforcement problem in a single advisory that it says "affects all Gemini CLI GitHub Actions."
Novee also found that Gemini CLI parsed its tool allowlist only at tool registration; at runtime nothing enforced that allowlist, and when the client was used with the --yolo flag every command the model requested was auto-approved. The fixes are released in Gemini CLI 0.39.1 and run-gemini-cli 0.1.22.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogClaude Code: one-character exfiltration via Hugging Face counter (CVE-2026-54316)
CVE-2026-54316 turned Hugging Face's public download counter into a covert exfiltration channel that leaked an API key one character at a time. Anthropic reported that exploitation required getting untrusted content into a Claude Code context; Novee reported the practical exfiltration mechanism. Anthropic rates the flaw Moderate at CVSS v4 6.0, while the National Vulnerability Database assigned a CVSS v3.1 score of 9.1 (the two scores are not directly comparable). The bug is fixed in Claude Code 2.1.163, and Novee notes every Claude Code release from 0.2.54 up to 2.1.163 is affected.
Novee additionally described a separate Claude Code validation quirk: the command validator strips single-quoted text before running its 23 checks, which aligns with bash behavior, allowing a payload placed in the value of git push --receive-pack — a flag git executes — to reach the runner untouched. That chain, Novee said, produced no CVE and Anthropic has stated fixes where applicable.
OpenAI Codex: repository workflow change, no CVE
The Codex finding produced neither a product-version patch nor a CVE. Novee observed that the openai/codex repository ran two Codex passes inside a single job sharing one checkout; the first pass could write AGENTS.md, the file the second pass loads as instructions. When JSON validation between passes failed, that launched the second pass with the repository-templated instruction file present.
OpenAI changed the workflow: the passes now run in separate jobs, Codex runs under drop-sudo and a read-only sandbox, and guidance was updated to list repository instruction files among content that "should be considered part of the untrusted input surface." OpenAI also recommends running Codex as the last step in a job to avoid leaving files behind for privileged steps. These are repository-level workflow mitigations rather than a demonstrated change to how Codex itself treats writable instruction files.
What this means for technologists, procurement teams, and regulators
- Technologists and security teams: Novee recommends updating Gemini CLI to 0.39.1, run-gemini-cli to 0.1.22, and Claude Code to 2.1.163, and auditing any GitHub workflow an outside user can trigger. The fixes address a container-launcher command-injection, runtime allowlist enforcement, and a Claude Code exfiltration channel; organizations should prioritize those package versions in CI/CD inventories.
- Procurement and enterprise engineering leaders: the Codex case illustrates that a safe product build can be undermined by how CI workflows are composed. The practical step is to treat repository instruction files and any third-party-supplied workspace artifacts as untrusted input and enforce separation of duties and read-only sandboxes in CI jobs.
- Regulators and incident responders: CISA's entries on both tracked CVEs list exploitation as none; The Hacker News confirmed on August 7 that neither CVE appears in the agency's Known Exploited Vulnerabilities catalog. However, a public GitHub repository describing itself as a reproduction lab for the Claude Code flaw has been public since June 18, and Pillar Security reported on August 4 that ChainDrop operators had planted Claude Code SessionStart hooks and a VS Code folderOpen task in compromised repositories — showing how similar techniques can be weaponized in the wild.
Two CVEs are patched, one significant workflow issue has changed behavior through job separation and sandboxing, and one additional Claude Code chain remains documented without a CVE. Novee's core observation — that a harness can mark a value safe and a later component act on that value with expanded authority — is a reminder that security is often broken at the seams between components, not inside the models themselves. The immediate task is inventory, patching, and auditing any externally triggerable workflow; the longer-term question is whether similar harness assumptions exist across other agent tooling and how quickly those assumptions will be found and fixed.
