Critical cybersecurity update: Critical Flaws in Anthropic, Google, and OpenAI’s Coding Agents Enable RCE and Supply Chain Attacks. NetworkFix reviewed the available source material to summarize the security issue, its potential impact and the defensive actions administrators should prioritize.
What Happened
A repeatable vulnerability pattern across AI coding agents from Anthropic, Google, and OpenAI that allows attackers to achieve remote code execution, steal API credentials, and compromise software supply chains, all without any privileged access. The flaws were discovered by Novee security Researcher Elad Meged testing each vendor’s default configuration on their own public repositories, meaning […] The post Critical Flaws in Anthropic, Google, and OpenAI’s Coding Agents Enable RCE and Supply Chain Attacks appeared first on Cyber Security News . Critical Flaws in Anthropic, Google, and OpenAI's Coding Agents Enable RCE and Supply Chain Attacks A repeatable vulnerability pattern across AI coding agents from Anthropic, Google, and OpenAI that allows attackers to achieve remote code execution, steal API credentials, and compromise software supply chains, all without any privileged access. The flaws were discovered by Novee security Researcher Elad Meged testing each vendor’s default configuration on their own public repositories, meaning the exposure isn’t theoretical; it’s live on the exact code millions of developers run today. The core issue lies not in the AI models themselves but in the “harness,” the surrounding code that manages tool permissions, execution, and sandboxing around each agent. Researcher Elad Meged found that a single GitHub issue, opened by an anonymous stranger with zero privileges, was enough to trigger the agent and smuggle in prompt-injection payloads that the harness failed to properly contain. Because these agents often run autonomously in CI/CD pipelines with no human reviewing every action, a malicious instruction hidden in an issue or pull request can travel straight through to code execution . On Anthropic’s own claude-code repository, researchers achieved remote code execution by exploiting a mismatch between Claude’s command validation logic and how the shell actually interprets quoted strings, allowing a malicious git push –receive-pack flag to bypass twenty-three security checks and execute arbitrary code on the runner.
Technical Details
After Anthropic patched the flaw, researchers found a second bypass using the read-only command tac to read arbitrary files, including exfiltrating a reversed API key through a public GitHub Actions log . A third round used HuggingFace’s public download counter as a covert side channel to leak an API key one character at a time, ultimately assigned CVE-2026-54316. Google’s Gemini CLI, running on a repository with over 106,000 stars and roughly two million monthly installs, suffered from two compounding flaws: a “restricted” shell tool allowlist that was never actually enforced at runtime, and an environment-sanitization scheme that cleaned secrets from the child process while leaving them fully exposed in the parent process via /proc. Combining full shell access with easily readable credentials let attackers escalate from a single anonymous issue to pushing malicious code directly into the main branch, a compromise Google rated CVSS 10.0 in its own security advisory and addressed with a breaking change to its headless execution trust model . OpenAI’s Codex workflow on its own repository ran two agent passes sharing a single workspace, and while OpenAI had already protected sensitive directories like .git and .codex from tampering, it overlooked AGENTS.md, the default instruction file the agent loads and trusts on every run. Attackers could poison this file during the first pass so that the second, “safe” pass inherited malicious instructions, along with whatever elevated permissions or tokens it carried. OpenAI fixed its own repository within three days by separating the two passes into isolated jobs, but researchers warn that the underlying multi-pass agent pattern is still widely copied elsewhere. Novee Security emphasizes that none of these were simple misconfigurations, they were correct security decisions that broke down at handoff points between different parts of each system. The same vulnerable defaults were found running on more than a hundred public repositories beyond the three vendors tested, meaning any organization running these coding agents in automation likely inherited the same exposure.
Security Impact
Organizations using the affected technology should treat the report according to its critical severity classification. The researchers recommend treating every file a workflow writes, and every workflow itself, as an untrusted input surface rather than assuming vendor defaults are safe out of the box. Gurubaran KS is a cybersecurity analyst, and Journalist with a strong focus on emerging threats and digital defense strategies. He is the Co-Founder and Editor-in-Chief of Cyber Security News, where he leads editorial coverage on global cybersecurity developments. Three PhaaS Kits Targeting US Organizations to Steal M65 Logins by Bypassing MFA Top 10 Phishing Kits Used by Hackers to Launch Cyberattacks (July 20-26, 2026) An SOC Story of Why Fast Answers Beat Perfect Answers in Cyber Incident Response How DCSync Attack Helps Hackers Steal Password Hashes Silently from Active Directory Top 10 Malware Used by Hackers Between July 20-26, 2026, to Launch Cyberattacks 4,400+ Internet-Exposed Rockwell PLCs Expose Water Systems to Cyberattacks Vanta Stealer Empties Browser Vaults, Crypto Wallets and Gaming Accounts in Minutes Hackers Can Leverage WSUS Servers to Deliver Malware and Compromise Enterprise Endpoints Top 10 Best Intrusion Detection & Prevention (IDS/IPS) Tools in 2026 Critical Paperclip Vulnerabilities Allow Attackers to Gain Admin Access CMMC Phase II Is Paused, But Contractors’ Data-Security Obligations Are Not Security in the AI Era Starts with First Principles Planning Your AI Security – How will You Manage All Your Resources? How Pro-Iran Hacktivist Networks Mobilize During Kinetic Conflict Why AI-generated identities mean verification can no longer be a one-time check Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Ransomware Gangs Attack Palo Alto, Fortinet, Citrix, and Check Point VPNs to Target Corporate Networks A coordinated wave of exploitation targeting edge VPN and… How Infostealer Logs Became the Fuel Behind Massive Cloud Data Breaches Infostealer malware has quietly become the single most important…
Recommended Actions
- Identify whether the affected product, service or software is present in the environment.
- Review the original vendor or research advisory and verify affected versions before making configuration changes.
- Apply vendor-provided security updates or mitigations as soon as operationally practical.
- Review relevant security logs and monitoring alerts for signs of suspicious activity associated with the reported issue.
- Use the CVE identifiers, where available, to validate exposure through vulnerability-management and asset-inventory tools.
Security Details
- Severity: Critical
- Original source: Cybersecurity News
Why This Matters
Cybersecurity teams should use reports like this as an input to risk-based vulnerability and threat management rather than relying on headline severity alone. Exposure depends on whether the affected technology is deployed, reachable by an attacker and protected by compensating controls. Confirming asset ownership, affected versions and available vendor fixes helps teams prioritize remediation while avoiding unnecessary emergency changes.
Original Report
NetworkFix recommends reviewing the complete original report from Cybersecurity News for the authoritative technical context, affected versions, indicators and vendor-specific remediation details: Read the original report.
