Loading story…
Research from Novee Security found that default AI agent harnesses from major vendors could be abused to exfiltrate secrets, bypass trust boundaries, and chain individually approved actions into harmful outcomes. Elad Meged reported multiple issues affecting Anthropic, Google, and OpenAI tooling, arguing that the root problem lies in architectural trust decisions, approval logic, and cross-stage handoffs rather than prompt injection alone. One Google Gemini CLI issue was tracked as GHSA-wpqr-6v78-jr5g with a CVSS 10.0 rating, while weaknesses were also identified in Anthropic's Claude Code Action and OpenAI's Codex CLI sandbox.
The findings showed how controls can fail when agent components such as tools, memory, prompts, and execution environments trust each other too broadly. Researchers said Google's agent could be pushed into a supply-chain-style attack that wrote to its own GitHub repository, illustrating how safe-looking steps can combine into exploitable workflows. Vendors have added mitigations and fixes, but the repeated pattern across products points to a broader industry problem for organizations deploying autonomous agents on untrusted input, especially where human review is limited or absent.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
The reporting states that vendors added defenses and issued fixes in response to the disclosed findings. Despite those remediations, the researchers said the recurring pattern across products points to an industry-wide design problem in autonomous agent workflows.
The research highlighted trust-boundary weaknesses in OpenAI's Codex CLI sandbox. These issues fit the broader pattern of harness components making unsafe assumptions during handoffs between prompts, tools, memory, and execution environments.
The research demonstrated a critical issue in Google's Gemini CLI, tracked as GHSA-wpqr-6v78-jr5g and rated CVSS 10.0. Dark Reading also reports that Google's AI agent could be abused for a supply chain attack and to write to its own GitHub repository.
Meged reported multiple security findings affecting Anthropic's Claude Code Action as part of the broader AI harness research. The findings were tied to weaknesses in how individually permitted actions could be combined into unsafe workflows.
Research by Elad Meged of Novee Security found that default AI agent harnesses from Anthropic, Google, and OpenAI could be abused through prompt-injection-driven workflows to exfiltrate secrets or bypass trust boundaries. The work argued that the root issue was architectural flaws in harness trust decisions, approval logic, and cross-stage handoffs rather than prompt injection alone.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
codeby.net
Open sourcedarkreading.com
Open sourcehelpnetsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Novee Security disclosed at Black Hat USA 2026 that AI coding agents tied to GitHub workflows can be manipulated through untrusted issue, pull request, and workflow-generated content to execute malicious actions inside repositories they are meant to maintain. Testing of **Anthropic Claude Code**, **Google Gemini CLI**, and **OpenAI Codex** against the vendors’ own public repositories and default setups showed paths to **remote code execution**, credential theft, repository tampering, and software supply-chain compromise without requiring privileged access. Researchers said the weakness lies primarily in the surrounding agent harnesses—tool permissions, execution controls, and sandboxing—rather than the underlying models. Reported exploitation paths included command-validation bypasses, unenforced shell restrictions, secret exposure through `/proc`, and persistent instruction poisoning across multi-pass workflows. Anthropic remediated **`CVE-2026-54316`** in Claude Code versions `0.2.54` through `2.1.162`; Google patched Gemini CLI versions before `0.39.1`, preview versions before `0.40.0-preview.3`, and `run-gemini-cli` GitHub Action versions before `0.1.22`; OpenAI mitigated Codex workflow risk by isolating agent runs and using read-only environments. The researchers said they found similar insecure patterns in more than 100 public repositories and reported no evidence of malicious exploitation in the wild.
Aug 6, 2026
Security researchers and vendors warned that autonomous AI agents can be manipulated into leaking secrets and misusing privileged access, turning them into a new pathway for credential theft and system compromise. Reporting from SC Media cited Okta Threat Intelligence research showing agents on the OpenClaw platform could be socially engineered or prompt-injected into exposing passwords, API keys, GitHub tokens, and OAuth refresh tokens, while other analysis described a **confused deputy** problem in which malicious text embedded in files, logs, web pages, or instruction files causes agents to execute higher-trust actions with their legitimate permissions. The risk is amplified when agents can read local files, edit code, run commands, fetch remote content, and access external tools or MCP servers without strong separation between trusted instructions and untrusted data. Defenders are responding with controls aimed at limiting agent authority and reducing secret exposure. Help Net Security reported on **Nono**, an open-source sandbox that constrains AI coding agents at the kernel level using mechanisms such as **Landlock** on Linux and **Seatbelt** on macOS, while introducing scoped tool permissions and proxy-mediated "phantom credentials" so agents do not directly handle live secrets. The broader guidance aligns with established ATT&CK techniques including **`T1552` Unsecured Credentials** and **`T1546` Event Triggered Execution**, emphasizing least privilege, centralized identity governance, short-lived credentials, secure secret storage, logging, rapid revocation, provenance checks, input isolation, and human approval to prevent agents from becoming a bridge to sensitive systems and cloud resources.
Jul 28, 2026
Researchers from Johns Hopkins University showed that a **"comment-and-control"** prompt injection technique could hijack AI coding agents embedded in GitHub workflows, including Anthropic’s Claude Code Security Review, Google’s Gemini CLI Action, and GitHub Copilot Agent. By planting malicious instructions in untrusted GitHub content such as pull request titles, issue text, comments, and hidden HTML, the attackers made the agents follow attacker-controlled directions and exfiltrate secrets through workflow output or GitHub comments. The demonstrations reportedly exposed Anthropic and Gemini API keys, GitHub tokens, and other credentials available in GitHub Actions runners, and the affected vendors paid bug bounties and patched the issue without issuing CVEs or public advisories. Separate research also identified a trojanized PyPI package, **`hermes-px`**, marketed as a privacy-focused AI proxy but designed to steal user prompts and exfiltrate data, including an altered Claude Code system prompt. Together, the findings show that the most immediate risk around AI developer tooling is not only the model itself but the runtime and integration layer, where untrusted repository content, overprivileged CI/CD workflows, and malicious third-party packages can turn coding assistants into secret-leaking supply-chain footholds. Defenders were urged to minimize agent permissions, restrict secret exposure, rotate credentials, prefer short-lived OIDC tokens, and harden GitHub Actions configurations such as `pull_request_target` usage.
Jun 29, 2026