Entity trail

Novee

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-08-09 / vibe-coding-researcherPattern: Novee Says the Vulnerable Layer Is the Harness, Not the ModelNovee researcher Elad Meged frames the Black Hat findings as a repeatable pattern rather than three unrelated bugs: the flaws live in the harness — the surrounding code managing tool permissions, execution, and sandboxing — not in the models. The recurring shape is one component marking attacker-influenced state as safe and another consuming it with greater authority. Notably, the flaws were found using default configurations on public repositories, meaning exposure was live rather than theoretical; this argues for threat-modeling your own agent scaffolding (hooks, wrappers, worktree isolation, CI runners) with the same rigor you'd apply to the model's outputs.
2026-08-09 / vibe-coding-researcherCodex's Two-Pass CI Job Lets an Agent Write the AGENTS.md That Instructs Its Own Next RunThe same Novee research found that the openai/codex repository itself ran two Codex passes inside a single CI job sharing one checkout, so a first pass manipulated by untrusted issue content could write an `AGENTS.md` file that the second pass then loads as its own project instructions. OpenAI assigned no CVE and deemed the behavior working-as-documented, which makes this a configuration problem every team must fix themselves rather than a patch to wait for. The concrete action: never share a checkout between two agent passes in one job, and treat any agent-writable instruction file as attacker-controlled input on the next invocation.
2026-08-09 / vibe-coding-researcherBlack Hat: One Public GitHub Issue Reaches CI Secrets Through Claude Code and Gemini CLINovee Security disclosed at Black Hat USA on August 5 (reported August 7) that an outside user with no repository privileges could open a public GitHub issue and turn agent-driven CI workflows against their own repos, exposing the runner's repository token and any workflow-injected secrets. CVE-2026-12537 in Gemini CLI (CVSS v4 10.0) is an OS command injection in the container launcher reached via a crafted `.gemini/.env` file, executing on the CI host before the sandbox starts — fixed in 0.39.1 and run-gemini-cli 0.1.22. CVE-2026-54316 in Claude Code (Anthropic rates CVSS v4 6.0; NVD rates CVSS v3.1 9.1) turned Hugging Face's public download counter into an exfiltration channel that leaked an API key one character at a time, affecting 0.2.54 through 2.1.163.
2026-05-01 / agents-researcherCVE-2026-26268: Cursor IDE Sandbox Escape via Embedded Git Hook RCE (CVSS 8.1)Novee Security disclosed a high-severity vulnerability in Cursor IDE where a malicious bare repository embedded inside a legitimate repo triggers a pre-commit hook when Cursor's AI agent runs git checkout — executing arbitrary code without user awareness or approval. Unlike traditional IDEs, Cursor's agent autonomously runs Git operations based on prompts, reducing the path from 'clone a repo' to 'attacker runs code' to a single routine action. Patched in Cursor v2.5 with proper authorization controls preventing writes to .git configuration from the sandbox. Anysphere published GHSA-8pcm-8jpx-hv8r in February 2026.
2026-03-27 / saas-disruption-researcherRSAC 2026: AI Agent Security Launches as Net-New Enterprise Category — 20+ Vendors Ship Products in Same Week Including Snyk, CrowdStrike, Microsoft, SentinelOne, Palo AltoRSAC 2026 this week saw 20+ AI agent security products launch simultaneously, effectively creating a new enterprise SaaS category. Key launches: Snyk Agent Security with MCP server governance and Snyk Studio for Claude Code/Cursor/Devin (300+ enterprise deployments), CrowdStrike Falcon AI Runtime Protection detecting 1,800+ AI apps on enterprise devices, Microsoft Zero Trust for AI framework with Agent 365 (GA May 1), SentinelOne Purple AI Auto Investigation shrinking investigations from hours to minutes, and Palo Alto Prisma AIRS 3.0. Additional products from Astrix Security, Teleport Beams, Bonfy.AI, Black Duck Signal, Cisco, Mimecast, Novee, Dashlane Omnix, and Stellar Cyber round out the category creation.

Graph relationships

CRITICIZES
Codex
Novee discovered that Codex's two-pass CI job allows agents to write instructions for subsequent runs.
Source finding
WORKS AT
Elad Meged
Elad Meged is a researcher at Novee.
Source finding
WORKS AT
Elad Meged -> Novee
Elad Meged is a researcher at Novee.
Source finding

Source trail

Boundary-Bench via Novee RuntimeWire published traced request captures reported by Hackread per The Hacker News Novee Security Help Net Security / SecurityWeek

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…