An unauthorized GitHub issue raised by a user without repository permissions allowed malicious code execution on CI runners associated with Anthropic and Google’s AI development repos This article explores accessible malicious gemini. . Novee Security conducted an attack targeting vendors' agents as shipped with them, presenting results at Black Hat USA on August 5.
Gemini CLI suffers from a severe OS command injection vulnerability, accessible via a malicious .gemini/.env file that can be exploited to execute code on the host system of a headless CI platform before the container starts. The Gemini host-execution bug didn't necessitate convincing a model to do anything.
Across all three instances, the recurring failure was found in the harness—a set of code surrounding the model that dictates what actually runs: one part marked the value safe, while another later acted on it with greater authority. The company now includes repository instructions in its "untrusted input surface" guidance, recommending that Codex be run as the final step to prevent leaving behind files for privileged actions following those steps. Neither of these changes indicate that Codex itself handles writable instruction files differently; instead, they represent updates to the repository workflow and documentation.
This development comes as Pillar Security reported on August 4 that operators of the ChainDrop npm worm inserted a Claude Code SessionStart hook and a VS Code folderOpen task into compromised repositories.
