Recent findings have revealed significant security vulnerabilities in AI coding agents from Anthropic, Google, and OpenAI. These vulnerabilities enable attackers to execute remote code, steal API credentials, and compromise software supply chains without needing privileged access. The issues were identified by Elad Meged, a researcher at Novee Security, who discovered that the problem lies not in the AI models themselves but in the surrounding code, known as the harness. This code manages permissions, execution, and sandboxing for each agent, but fails to adequately contain prompt-injection payloads.
In one instance, researchers demonstrated remote code execution on Anthropic’s Claude-code repository by exploiting command validation logic that was misaligned with how the shell interprets quoted strings. Even after an initial patch, further vulnerabilities were identified, such as using the read-only command 'tac' to exfiltrate API keys. Similarly, Google’s Gemini CLI suffered from unenforced shell tool restrictions and inadequate environment sanitization, leading to a CVSS 10.0-rated vulnerability.
OpenAI’s Codex workflow was vulnerable due to reliance on a shared workspace for two agent passes, which allowed attackers to inject malicious instructions. OpenAI addressed the issue by isolating the two passes, but the multi-pass pattern remains a concern across other implementations. Novee Security advises organizations to treat all workflow files as untrusted inputs and not to assume vendor defaults are inherently secure, as the same vulnerabilities were found on over a hundred public repositories.