Claude Code and Gemini CLI in CI: a public issue could put secrets at risk

Novee Security researchers showed how an agent automatically handling public issues can inherit CI secrets while processing data controlled by anyone on the internet. In the Gemini CLI and Claude Code configurations they analysed, the risk was not only that a model could be persuaded. Critical weaknesses lived in the harness around it: configuration-loading order, the point at which sandboxing began and the network channels available to tools.

That distinction matters. A prompt filter may reduce successful manipulation, but it cannot repair a process that reads an untrusted file before establishing isolation or gives the model a secret while permitting unconstrained requests.

Gemini CLI: execution before the sandbox boundary

CVE-2026-12537 affected the run-gemini-cli action. A malicious .gemini/.env file in a repository could influence container-launch parameters. The launcher used those values before establishing the intended isolation, creating a path to command execution on the runner host in an unattended workflow.

Google’s run-gemini-cli advisory rates the issue critical under CVSS v4. Fixes were released in Gemini CLI 0.39.1 and run-gemini-cli 0.1.22. Both vendor-listed components should be upgraded, after which workflow pins must be refreshed to a safe commit or tag.

The mechanism demonstrates a useful rule: pre-sandbox is host. Every action completed before namespaces exist, filesystem access is constrained, seccomp is applied and capabilities are dropped belongs to the host attack surface. Calling a workflow “containerised” does not cover its bootstrap phase.

Claude Code: a secret left through an innocuous counter

The second case, CVE-2026-54316, involved Claude Code in automation. Novee’s description says a public Hugging Face download counter could act as the exfiltration channel. A sequence of controlled requests encoded an API key one character at a time, even though no individual call resembled a conventional secret upload to an attacker webhook.

Releases from 0.2.54 up to, but excluding, 2.1.163 were affected; the fix landed in 2.1.163. The technique matters because it demonstrates the limit of simple domain allowlists. A destination may be legitimate while its state — a resource name, counter, access log or cache key — carries attacker-controlled data.

Researchers also discussed a Codex scenario in which data persisted by one run affected the next agent invocation. No CVE or product patch was described; OpenAI’s position was that the sandbox operated according to its documented model. The three cases should therefore not be merged into one vulnerability. Their shared architectural mistake is allowing state from an untrusted author to enter a later context with greater authority.

A safer agent workflow for CI

1. Upgrade Gemini CLI to at least 0.39.1, run-gemini-cli to 0.1.22 and Claude Code to 2.1.163, or later vendor fixes.
2. Pin actions to full commit hashes and detect changes automatically. A tag is convenient but provides weaker integrity evidence.
3. Do not provide workflow secrets to jobs triggered by a public issue, comment, fork pull request or other untrusted event.
4. Separate analysis from execution: an initial secretless job produces an artefact, and a distinct approved job may use a narrowly scoped token.
5. Establish the sandbox before reading repository files. Project configuration is attacker input, not trusted bootstrap material.
6. Constrain egress by required method, path and size, not only domain. Log every tool call together with its originating event.
7. Use short-lived, least-privilege tokens that are separate per repository and environment; after an incident, revoke dynamically obtained credentials too.
8. Clear the workspace and agent memory between trust levels. An artefact from an untrusted run must never become instructions in a trusted job.

Facts and Breachroad analysis

Google’s advisory confirms CVE-2026-12537, its impact and fixed releases. Novee describes CVE-2026-54316 and the exfiltration channel in its tested workflow. Not every user of these tools was exposed: automation had to combine untrusted input, tools and secrets. The two-job pattern and treating repository configuration as hostile are Breachroad recommendations derived from those trust boundaries.

Secure AI and CI/CD training helps teams design these boundaries before an agent is deployed. An AI security assessment examines the runner, tokens, egress and persisted workflow state as well as the prompt.