Black Hat: critical flaws in Anthropic, Google and OpenAI coding-agent automations
At Black Hat 2026, Novee showed that automations built on coding agents from Anthropic, Google and OpenAI can be exploited; in Codex, for example, a writable instruction file gives persistent control over the next agent. Google deleted three ADK workflows because a public GitHub issue could manipulate a privileged agent, and a Gemini agent-to-agent attack leaked secrets.
Who is affected and how
- tech lead
- Issue and PR text must be treated as untrusted input in every agent automation.
- senior developer
- AI code-review bots should not be given broader GitHub access than they need.
Sources
- Black Hat 2026: If You Run These Automations, You’re Exposed Too: Critical Flaws in Anthropic, Google, and OpenAI’s Coding Agents | Noveenovee.security · Aug 5, 2026
- Critical Flaws in Anthropic, Google, and OpenAI's Coding Agents Enable RCE and Supply Chain Attackscybersecuritynews · Aug 6, 2026
- Prompt Injection Attacks on AI Coding Agentsmatthewswong.com · Aug 8, 2026
- Google Deletes 3 ADK AI Workflows After Malicious GitHub Issue Could Trigger Privileged Agentthehackernews.com · Aug 4, 2026
- Google verwijdert drie ADK AI-workflows nadat een kwaadaardig GitHub-probleem een Privileged Agent zou kunnen activerentechidee.nl · Aug 5, 2026
- Gemini Agent-to-Agent Attack Method Exposed Secrets, Enabled Pull Request Tampering - SecurityWeeksecurityweek.com · Aug 4, 2026
- Gemini agent-to-agent attack exposes secrets and enables pull request tamperingcryptobriefing.com · Aug 4, 2026
- How to automate AI code review with GitHub Actions | Scopy AIscopy.dev · Aug 4, 2026
Machine-generated summary based on the titles and excerpts of the source articles. The facts come from the linked article.