Three AI Coding Agents, Three Ways to Break Them, and One Thing Detection Will Never Give You
Three AI Coding Agents, Three Ways to Break Them, and One Thing Detection Will Never Give You I've spent the last week reading through the technical writeups from Novee Security's Black Hat USA 2026 briefing, "Trusted Enough to Run: Breaking AI Agents in Official Workflows." The title sounds broad. The content is not. They found three distinct, exploitable vulnerabilities in three of the most…
Three AI coding agents have distinct vulnerabilities that highlight a critical issue in their design. The vulnerabilities exist within Claude Code, Gemini CLI, and OpenAI Codex, all of which are widely used tools. These flaws demonstrate that detection alone is insufficient to safeguard against AI agent exploitation. Each vulnerability stems from a trust handoff failure, where the agent's validator trusts that the input it receives is exactly what will execute.
This trust failure enables attackers to manipulate the agents by injecting malicious commands or environment variables, leading to potential supply chain compromises. The root cause lies in the architecture of these agents: they trust the sanitized representation of input, unaware that attackers can bypass this validation. The vulnerabilities expose the need for cryptographic evidence to prove what actually occurred after trust boundaries are crossed, as detection cannot ensure the integrity of the trust handoff.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
