AI Pulse · Under the Radar

A security finding now surfacing in the trade press is a useful reminder that AI coding tools can leak data in places nobody thinks to inspect. Researchers at Novee Security found flaws in Claude Code, Gemini CLI and Codex that each created a path for instructions or secrets to cross boundaries they should not cross.

In Claude Code, the issue involved Hugging Face’s public download counter. An attacker could use that innocent-looking telemetry signal as a covert channel, sending secret data out one character at a time from inside the sandbox. The affected range covered releases 0.2.54 through 2.1.162. Gemini CLI could be hit through a crafted .gemini/.env file that enabled operating system command injection. In Codex, a shared job checkout could allow one job to plant instructions that the next job would blindly load. All three vendors have patched the reported flaws, according to the trade press report.

The bigger business lesson is not that these three tools are uniquely unsafe. It’s that public telemetry, shared workspaces and configuration files can become side channels when an AI agent has access to code, credentials or production-adjacent systems. If your team is using coding agents, treat their environment like any other automated worker. Limit what secrets they can read, separate jobs and repositories, review configuration files, and keep versions current.

This is the kind of thing we build into an AI command centre, where agent activity, access and exceptions can be made visible before a small technical shortcut becomes a security incident.