Your agent framework is the attack surface

If you have wired an AI coding agent into your GitHub repository so that it responds to issues and pull requests, this article is about you. It is the most practically useful research to come out of Black Hat this year, and the finding is simple: the thing that gets you is not the model. It is the code around the model.

On 5 August, Elad Meged of Novee Security presented vulnerabilities in the coding agents from all three major vendors — Anthropic’s Claude Code, Google’s Gemini CLI and OpenAI’s Codex. The attack needed nothing more than a GitHub account with no privileges and no relationship to the project. Open an issue. Put instructions in it. Wait for the agent to read it. In the vendors’ own repositories, running the default configurations they ship, that was enough to execute code on the CI runner, steal the workflow’s tokens (including the GitHub token and the vendor’s own API key), and in some cases modify the repository or publish packages under its name. All three vendors released fixes. Two CVEs came out of it.

The details show how hard this is to get right. Claude Code went through three rounds. The first flaw was in how the agent validated shell commands — a crafted git push slipped past the check. Anthropic patched it. Novee found the fix relied on a hardcoded list of “read-only” commands exempt from scrutiny, and got around that. Anthropic patched again. The third finding, CVE-2026-54316, used the agent’s pre-approved access to Hugging Face to leak secrets through public download counters — a side channel nobody had thought to close. Codex was different: two agent passes in one job share a workspace, so the first can write an instructions file the second treats as authoritative. OpenAI declined to classify that as a vulnerability at all, calling it a design decision.

A second talk widened the lens from vendor products to the open-source frameworks many teams build on. LangChain, CrewAI, AutoGen and Semantic Kernel were all shown to have exploitable logic in their core runtimes — memory stores, planning loops, serialisation layers. The consequence: injected content can hijack an agent even if the agent has no tools. The security model most teams use — “control what the agent can call” — is necessary and not sufficient.

Meged’s own summary is the one to keep: the harness is the code between the model and the real world, and the harness is what failed. Novee found the same patterns in more than a hundred public repositories. If your automation reads text from strangers and holds credentials, assume you are one of them until you have checked.