The attack surface is the harness, not the model
The most important finding out of Novee's Black Hat disclosure sits above any single CVE: it is where all three vulnerabilities lived. Researchers were explicit that the exploitable weaknesses came from how each vendor's agent harness manages tool access, permissions, and orchestration around the model, rather than from a flaw in the underlying language model's training or output. That distinction matters enormously for how enterprise security teams should scope their AI coding agent risk assessments, since it points budget and attention toward a layer many teams have not yet audited closely.
Model-level security work, red-teaming for harmful outputs, alignment testing, gets significant vendor and research attention. Harness-level security, the code that decides what an agent is allowed to touch once it receives an instruction, has received comparatively less scrutiny until this disclosure. Enterprises evaluating AI coding agents need to ask vendors specifically about harness security controls, not just model safety benchmarks, because this research shows that is where the exploitable gap currently sits.
Claude Code: a GitHub issue that stole credentials
In Anthropic's Claude Code, researchers demonstrated a prompt injection delivered through a GitHub issue that led directly to remote code execution, giving attackers the ability to read arbitrary files and steal both GitHub and Anthropic API credentials from the compromised environment. Anthropic assigned CVE-2026-54316 to the flaw and issued multiple patches in response, treating it as a serious enough finding to warrant a formal CVE rather than a quiet fix pushed without public disclosure.
The attack vector, a GitHub issue, is significant because it requires no special access to trigger. Any user who can open an issue on a repository an agent has been configured to monitor or act on can potentially deliver the malicious payload, making this a low-barrier attack against any organization running Claude Code against externally visible or contributor-accessible repositories without adequate isolation.
Gemini CLI: a maximum-severity permission bypass
Google's Gemini CLI drew the most severe rating of the three disclosures, a CVSS score of 10.0, after researchers found a way to bypass the assumptions the tool made around restricted shell commands and environment isolation. The resulting attack chain enabled credential theft and created a potential path to software supply chain compromise, since a coding agent with broken isolation can potentially modify build artifacts or dependencies an organization later ships.
Google's response went beyond a point patch: the company changed its trust model for non-interactive environments, an architectural response rather than a narrow fix. That distinction is worth noting for enterprise security teams evaluating vendor response quality, a vendor that changes its trust model in response to a finding is signaling the issue reflected a design assumption problem, not an isolated coding bug.
Codex: instructions that outlive their workflow stage
OpenAI's Codex vulnerability worked differently. Researchers found that a writable AGENTS.md file, a configuration file meant to give the agent context about a project, could be used to persist attacker-controlled instructions across multiple stages of an automated workflow. Once planted, the malicious instructions did not need to be reinjected at each step, they simply carried forward as the agent moved through subsequent automated tasks, quietly shaping behavior long after the initial injection point had been forgotten.
OpenAI's fix separated workflow stages and explicitly documented the AGENTS.md file as untrusted input going forward, a meaningful architectural change. Researchers cautioned, however, that similar multi-pass workflow patterns exist elsewhere in the agentic tooling ecosystem and likely remain vulnerable to the same class of persistence attack outside OpenAI's specific fix, meaning this is a pattern for security teams to test for broadly rather than a single closed issue.
What enterprise security and platform teams should do now
All three vendors have shipped mitigations, but patched CVEs are a floor, not a ceiling, for enterprises running these tools inside CI/CD pipelines and developer workflows. Security teams should treat any AI coding agent with write access to repositories, credentials, or automated workflow stages as requiring the same isolation discipline applied to a CI runner with production access: least-privilege credential scoping, sandboxed execution environments, and explicit distrust of any content the agent reads from external or user-supplied sources like issues, comments, or configuration files.
The broader signal from this disclosure is that agentic coding tools have crossed into genuine production infrastructure risk, not just productivity tooling risk. A compromised coding agent with API credentials and repository write access is functionally equivalent to a compromised CI/CD pipeline, and security teams that have not yet extended their pipeline security posture to cover AI coding agents specifically should treat this Black Hat disclosure as the forcing function to do so before their next security review cycle.
