---
title: "[AUTO] Coding agents leak secrets through pre-approved tools"
pubDatetime: 2026-08-07T16:01:00.000Z
description: "Novee Security research reveals critical flaws in Claude Code and Gemini CLI that let attackers reach CI secrets through allowlisted tool features."
tags: [ai-security, claude-code, sandboxing, security, 2026, 2026-q3, 2026-08, AUTO]
---
[Novee Security disclosed three critical flaws in Claude Code](https://novee.security/blog/critical-flaws-in-anthropic-google-and-openais-coding-agents/) at Black Hat 2026. The most striking: a data exfiltration channel that uses a pre-approved HuggingFace domain in WebFetch to leak secrets one character at a time, rooted not in misconfiguration but in the foundational harness architecture itself.

The exfiltration trick is revealing. Attackers don't break out of the sandbox; they weaponize its flexibility. An agent can fetch files from HuggingFace (reasonable for a coding tool), so an attacker creates a repo there, then triggers a malicious clone that queries the repo's download counter with secret data baked into the URL. No outbound connection violation, just signal extraction through a permitted channel.

[Google's Gemini CLI had its own CVSS 10.0 command injection hole](https://thehackernews.com/2026/08/claude-code-and-gemini-cli-flaws-let.html) via `.gemini/.env` files. [Anthropic's advisory (CVE-2026-54316)](https://github.com/anthropics/claude-code/security/advisories/GHSA-fg94-h982-f3mm) covers the Claude Code findings. The pattern is clear: agent isolation faces a fundamental gap. You can't lock down every tool without killing functionality. Security allowlists work until they don't. Pre-approved domains become covert channels.

---

*Sources: [Novee Security](https://novee.security/blog/critical-flaws-in-anthropic-google-and-openais-coding-agents/)  •  [Anthropic CVE-2026-54316](https://github.com/anthropics/claude-code/security/advisories/GHSA-fg94-h982-f3mm)*

*Coverage: [The Hacker News](https://thehackernews.com/2026/08/claude-code-and-gemini-cli-flaws-let.html)*

*Related on this blog: [[AUTO] ChatGPT's C2 Inside the Sandbox](/posts/auto-chatgpt-sandbox-c2)  •  [[AUTO] Meta's model didn't hack a company, the sandbox did](/posts/auto-meta-muse-sandbox-breach)  •  [Three Indirection Steps From a Reverse Shell](/posts/ai-agent-security-lethal-trifecta)*