Top AI coding agent security resources — September 2026

What it is

The page is Adversa AI's September 2026 roundup, but it carries specific technical mechanisms the catalog summary only names in passing. Three findings stand out beyond what's already captured: the exact bash-validator flaw behind the Claude Code CVE, two fresh Claude Opus 5 auto-mode exploit chains, and concrete detection guidance.

How it works

Claude Code GitHub Actions flaw: the bash command validator stripped single-quoted content before inspecting it, so git push --receive-pack=... read as empty to the validator and then executed as RCE, exfiltrating the API key and GitHub token. It took three rounds of patch-and-bypass before this was fixed.

Gemini CLI flaw (the CVSS 10.0 one): the tool-restriction annotation was purely decorative and never enforced at runtime, and secret-stripping was bypassed by reading /proc/$PPID/environ in a shared PID namespace.

Codex flaw: a two-pass workflow shared one writable checkout; the first pass wrote a poisoned AGENTS.md that the second pass loaded as authoritative instructions.

Auto-mode module-shadowing exploit: a request to summarize a URL gets a 415, Claude falls back to curl, pulls an archive, refuses to run a decoy binary, and instead writes its own Python decoder. Running import base64 from the extracted directory resolves the attacker's struct.py first via module shadowing, so Claude's own defensive rewrite executes the payload it had just refused. Succeeded in 60-80% of runs; the vendor closed the report as "Informative" with no fix.

Steganographic auto-mode exploit: payload hidden in a repo's only image walks the agent through a puzzle chain to RCE inside a sys.addaudithook() wrapper the agent builds itself as a safety measure — Python's own docs state this hook is not a sandbox.

flowchart TD
    A[Agent refuses decoy payload] --> B[Agent builds its own mitigation]
    B --> C{Is mitigation real sandboxing?}
    C -->|No - audithook/import order| D[Payload executes via the mitigation itself]
    C -->|Yes| E[Chain blocked]

Preconditions / Affected

Claude Code and Gemini CLI auto-mode/agentic configurations; default vendor-published GitHub Actions setups for Claude Code, Gemini CLI, and Codex; repositories where an agent has shell access and improvises its own containment.

What to do

git push --receive-pack=...

is the literal payload pattern that bypassed Claude Code's quote-stripping validator — worth grepping CI logs for. For Gemini CLI, check whether tool-restriction annotations are actually enforced at runtime, not just declared, and whether secrets are reachable via /proc/$PPID/environ in shared PID namespaces.

Caveats

The auto-mode module-shadowing report was closed by the vendor as "Informative" with no fix — this remains open/unpatched per the page. The steganographic image exploit's "containment" (sys.addaudithook()) was the agent's own improvisation, not a vendor control, so it doesn't indicate a product defect to patch, rather a pattern (agents building fake sandboxes) to distrust generally.