A security researcher who found the same class of vulnerability across AI coding agents from Anthropic, Google, and OpenAI has shared new technical details at Black Hat USA 2026, demonstrating live how trust decisions embedded in agent code can be exploited to steal secrets and execute arbitrary commands.
Elad Meged, a founding engineer and security researcher at Novee Security, first disclosed the findings in late July, with individual vulnerabilities reported by Help Net Security, Dark Reading, and CSO Online. At Black Hat, Meged presented the full attack chains for the first time, showing how the same trust-handoff failure recurs across Claude Code, Gemini CLI, and Codex: the product marks something as safe at one stage, but a later component consumes that state with more authority than the original decision accounted for.
Meged tested each vendor’s agent against its own repository using default configurations, meaning the vendors could not attribute the failures to user misconfiguration.
In Claude Code’s GitHub Action, Meged found three successive vulnerabilities, each discovered after Anthropic patched the previous one. Despite a 23-check security pipeline for command injection, a git flag treated as a harmless string by the validator was interpreted as a program path at runtime, giving arbitrary code execution. After Anthropic removed bash access, Meged exfiltrated secrets through auto-approved read commands and, ultimately, through public download counters on Hugging Face. Anthropic has since introduced new security capabilities for Claude Code.
In Gemini CLI, process-level environment sanitization failed because the child process could read the parent’s secrets through /proc. Google scored the finding CVSS 10 and redesigned the agent’s entire trust model. It is the latest in a series of Gemini agent vulnerabilities disclosed at Black Hat conferences.
In Codex, a shared workspace between two execution passes allowed an attacker to write malicious instructions to agents.md in the first pass, which the second, more privileged pass loaded as trusted. OpenAI split the workflow into isolated jobs.
The findings echo a broader pattern of AI agent exploitation research presented at recent Black Hat conferences, and follow earlier disclosures of prompt injection vulnerabilities in Claude. All vulnerabilities have been patched. Meged urged security teams deploying AI agents to audit every trust label the product applies — “safe,” “read-only,” “pre-approved” — and trace that state forward to see whether a later component consumes it with more power.
“When you deploy an agent, you inherit every assumption that the developer made for you,” Meged said. “Read the defaults, not the documentation.”
