Critical Flaws in Anthropic, Google, OpenAI Coding Agents Allow RCE

Key Takeaways

• Critical vulnerabilities were discovered in AI coding agents from Anthropic, Google, and OpenAI, enabling remote code execution and credential theft.
• The flaws exploited weaknesses in the “harness” code managing agent permissions and execution, not the AI models themselves.
• Exploits were demonstrated in the vendors’ default configurations on their public repositories, indicating live, widespread exposure.
• Patches have been released by the affected vendors, but the underlying vulnerability patterns may persist in other implementations.

A series of critical security vulnerabilities have been uncovered in AI coding agents developed by leading tech companies Anthropic, Google, and OpenAI. These flaws could allow attackers to achieve remote code execution (RCE), pilfer API credentials, and compromise software supply chains without requiring any privileged access.

The vulnerabilities were identified by Novee Security Researcher Elad Meged, who tested each vendor’s default configurations on their respective public repositories. This approach confirmed that the exposures are not theoretical but actively present in the codebases utilized by millions of developers today.

The root cause of these issues does not lie within the artificial intelligence models themselves, but rather in the “harness” – the surrounding code responsible for managing tool permissions, execution, and sandboxing mechanisms around each AI agent.

Meged’s research demonstrated that a single GitHub issue, opened by an anonymous, unprivileged user, was sufficient to activate the agent and inject malicious prompt-injection payloads that the harness failed to properly contain.

Given that these AI agents frequently operate autonomously within CI/CD pipelines, often without human oversight for every action, a malicious instruction embedded within an issue or pull request can bypass scrutiny and directly lead to code execution.

Anthropic’s Claude Code Patch and Bypass

On Anthropic’s own claude-code repository, researchers successfully achieved remote code execution. This was accomplished by exploiting a discrepancy between Claude’s command validation logic and the shell’s actual interpretation of quoted strings. This allowed a malicious git push –receive-pack flag to circumvent 23 security checks and execute arbitrary code on the runner.

Following Anthropic’s initial patch for this flaw, researchers discovered a second bypass. This method utilized the read-only tac command to access arbitrary files, including the exfiltration of a reversed API key via a public GitHub Actions log.

A third exploit leveraged HuggingFace’s public download counter as a covert side channel to leak an API key character by character. This particular vulnerability was assigned CVE-2026-54316.

Google’s Gemini CLI Supply Chain Risk

Google’s Gemini CLI, hosted on a repository boasting over 106,000 stars and approximately two million monthly installations, was found to suffer from two compounding weaknesses. The first was a “restricted” shell tool allowlist that was never actually enforced during runtime. The second involved an environment-sanitization scheme that, while cleaning secrets from child processes, left them fully exposed in the parent process via /proc.

The combination of unrestricted shell access and easily accessible credentials allowed attackers to escalate privileges from a single anonymous issue to directly pushing malicious code into the main branch. Google itself rated this compromise with a CVSS score of 10.0 in its security advisory and has since addressed it with a breaking change to its headless execution trust model.

OpenAI’s Codex Persistent Hijack

OpenAI’s Codex workflow on its proprietary repository executed two agent passes that shared a single workspace. While OpenAI had implemented protections for sensitive directories such as .git and .codex from tampering, it overlooked AGENTS.md, which is the default instruction file the agent loads and trusts on every run.

Attackers could poison this file during the initial pass, causing the subsequent, “safe” pass to inherit malicious instructions, along with any elevated permissions or tokens it carried.

OpenAI promptly fixed its own repository within three days by isolating the two passes into separate jobs. However, researchers caution that the underlying multi-pass agent pattern remains widely adopted elsewhere.

Novee Security emphasizes that these were not mere misconfigurations but rather breakdowns in correct security decisions at handoff points between different components of each system.

The same vulnerable default configurations were identified on over a hundred public repositories beyond the three vendors initially tested, suggesting that any organization utilizing these coding agents in automated workflows likely inherited the same exposure.

What You Should Do

• Treat every file written by a workflow, and the workflow itself, as an untrusted input surface.
• Avoid assuming vendor defaults for AI coding agents are inherently secure out of the box.
• Regularly review and audit CI/CD pipelines and agent configurations for potential prompt injection vectors.
• Implement robust sandboxing and privilege separation for AI agent execution environments.
• Stay informed about security advisories and promptly apply patches released by AI agent vendors.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.