One untrusted GitHub issue broke three coding agents at the harness, not the model

AI Security

One untrusted GitHub issue broke three coding agents at the harness, not the model¹

The boundary that decides whether an agentic coding tool is safe sits in the harness that assembles the model's context and runs its output, not in the model's weights. Novee's Elad Meged demonstrated it at Black Hat USA on August 5. On the default-configured repositories of Anthropic, Google, and OpenAI, a single GitHub issue filed with no repository privileges reached remote code execution and credential theft.¹ A second account puts the root cause in hidden trust assumptions built into the agent harnesses and common to all three, which is why one flaw class recurred across independent vendors.²

The three disclosed flaws, their identifiers, and the releases that fix them.³

Agent	What the flaw does	CVE / score	Fixed in
Gemini CLI	OS command injection: a crafted .gemini/.env runs on the CI host before the sandbox starts.	CVE-2026-12537 · CVSS 10.0	0.39.1
Claude Code	API-key exfiltration through Hugging Face's public download counter, one character at a time.	CVE-2026-54316 · NVD 9.1, Anthropic 6.0	2.1.163
Codex	Two passes share one checkout; the first writes an AGENTS.md the second loads as instructions.	none assigned	workflow change

The two scorers disagree on the Claude Code bug. NVD rates CVE-2026-54316 at CVSS v3.1 9.1, while Anthropic rates it CVSS v4 6.0. The fix landed in release 2.1.163. The bug affected every release from 0.2.54 to that fix. Only OpenAI's Codex drew no identifier, closed instead by separating the two passes so they no longer share a checkout.³

Semiconductors

SpaceX's $16.8 billion Terafab has no binding commitment behind it⁴

The $16.8 billion attached to SpaceX's Terafab commits no one to building the plant. Texas put its name to the project in Grimes County on August 6, a facility meant to combine logic, memory, and advanced packaging under one roof. The state cited a capital investment above $16.8 billion, 3,000 jobs, and a $30 million Texas Enterprise Fund grant to SpaceX.⁴ Tesla and SpaceX announced the joint project the same day on X, where the figure softens. The $16.8 billion is a first-phase number, down from the $25 billion cited in March. SpaceX's own May IPO filing called Terafab a "general framework" carrying no binding commitment from either party.⁵ Intel is named as the intended manufacturer, at an undisclosed scale, and Governor Abbott's official release names neither Tesla nor Intel.⁵⁴

AI Silicon

AMD acquires Taalas to cast model weights into silicon⁶

Casting a model's weights and dataflow directly into transistors, instead of streaming them from high-bandwidth memory at run time, is the bet AMD just paid for. On August 6 AMD signed a definitive agreement to acquire Taalas, a Toronto startup founded in 2023 that builds what it calls model-specific integrated circuits. AMD said it would fold the technology into a roadmap spanning Instinct GPUs, EPYC CPUs, and ROCm, on undisclosed terms.⁶ The performance case is entirely Taalas's own. It says its HC1 test chip, built on TSMC's 6nm process, served Meta's Llama 3.1 8B at close to 17,000 tokens per second. In February it put that rate at 73 times an Nvidia H200's, at one-tenth the power.⁷ AMD's release offers no benchmark of its own, and no independent measurement of the HC1 exists. The roughly $219 million Taalas has raised bought a single-model test chip, not a shipping product.⁷

Storage

Kioxia and SanDisk demonstrate the densest 3D NAND to date⁸

The densest 3D NAND yet demonstrated wins its density by stacking more layers and bonding the logic beneath the array, not by shrinking the memory cell. Kioxia and SanDisk showed a 332-layer, 10th-generation QLC part at the Future of Memory and Storage conference on August 4. They rate it above 37 gigabits per square millimeter, up to 60 percent denser than their 8th generation, over a 4.8 Gb/s interface.⁸ Independent hardware press confirmed the 332 active layers and the interface speed, up to 4,800 MT/s, and framed the part as a demonstration.⁹ The companies' own language points only toward commercialization, so the density is real and the product is not yet shipping.⁸