The Real AI Agent Risk: Safe on Paper, Dangerous in Motion
AI agent security vulnerabilities are weaknesses in the agent harness and workflow handoffs that allow secret leakage or exploitation even when initial safety checks and prompts appear compliant and benign, exposing enterprises to hidden credential and data exfiltration risks once agents start executing commands and sharing outputs in production environments. The uncomfortable truth is that an AI code agent can pass every safety review, satisfy all your prompt rules, and still leak secrets when the workflow runs. Anthropic’s pipeline handed over secrets in its default Claude Code Action configuration, and any organization running one of these agents out of the box carries the same exposure. That is not a niche lab problem—it is a systemic design flaw in how AI agents are built and trusted today.
Researcher Elad Meged has shown that the failure point is not the model but the harness—the glue code that turns intent into shell commands, file reads, and API calls. Safety checks focus on the prompt and deployment configuration, then stop. Once the agent begins operating without a human reviewing every step, the harness effectively becomes the security boundary, and it is riddled with assumptions. Enterprises that treat a green checkmark at deployment as a steady guarantee of safety are giving these assumptions direct access to their codebases, CI pipelines, and secrets.
How the Handoff Breaks: Claude Code, Gemini CLI, and Codex
Meged’s work against Claude Code, Gemini CLI, and Codex shows a consistent pattern: defenses exist, but they fail at the handoffs. With Claude Code Action—the default workflow for anthropics/claude-code, installed by millions—prompt injection was only the delivery mechanism. The real problem was how the harness made trust decisions and how those decisions composed across stages: a command looked safe and got approved, then its output was published by default, forming an exfiltration chain. In later rounds, Meged recovered secrets through a channel that survived every prior fix, with no outbound connection, no writes, and no logs. That should terrify anyone relying on audit trails as their safety net.
Google’s Gemini CLI was no better. Meged demonstrated a kill chain in google-gemini/gemini-cli—a repository with more than 100,000 stars—using the very security configuration the documentation recommends for CI workflows that handle untrusted input. A restriction the operator had configured went unenforced at the point of execution, yielding a vulnerability rated 10.0 on the CVSS scale. OpenAI’s Codex CLI ships with a sandbox and protected paths, but in multi-stage workflows sharing a workspace, state written by one stage is treated as trusted by the next, based on assumptions about what needs protecting. Across all three, vendors keep patching individual surfaces while the underlying architectural seam remains exposed.
From Safety Labels to Exploitation Chains: Why Enterprises Are Exposed
The core mistake is treating early safety decisions as permanent truth. Right now, harnesses make a safety call up front—“this command is read-only,” “this domain is pre-approved”—and downstream components inherit that label without re-checking whether it still holds in their own context. A read-only command feeding into a public output channel is not read-only in effect. A pre-approved domain serving attacker-controlled content is not safe in practice. Safety checks occur at deployment time, but agents then operate for hours or days without continuous validation, creating exposure windows exactly when the agent is most powerful and least watched.
These AI handoff security risks are no longer theoretical. A Chinese-speaking threat actor has run an AI-enabled autonomous hacking campaign using Hermes Agent and models like DeepSeek as an offensive operator. They targeted infrastructure through seven vulnerabilities in Langflow (CVE-2026-33017), n8n (CVE-2026-21858, CVE-2025-68613), Citrix NetScaler (CVE-2026-3055), Apache Tomcat (CVE-2026-34486), Marimo Notebook (CVE-2026-39987), Palo Alto Networks PAN-OS (CVE-2026-0300), and Microsoft Windows IKE Extensions (CVE-2026-33824). Hermes Agent handled orchestration—terminal access, Telegram-based command and control, and the skills system—while DeepSeek served as the reasoning engine for code generation, vulnerability assessment, target selection, and decision-making. If attackers are already using AI agents to automate exploitation, leaving your own agents unmonitored in production is reckless.
Enterprise AI Agent Threats: Secret Leakage in Plain Sight
For enterprise teams, the threat is not only remote code execution; it is undetected credential and data exfiltration hiding inside “approved” workflows. Anthropic’s pipeline handed over secrets in its default Claude Code Action setup, and any organization running one of these agents out of the box carries the same exposure. Most teams focus their audit on what the agent is allowed to do—the tools, paths, and commands. Meged’s findings show the exposure lies in what happens after: the handoff between “approved” and “executed,” “read” and “published,” “fetched” and “trusted.” When agent output is consumed by a later stage with broader privileges—such as deployment scripts, configuration loaders, or CI tasks—your initial safety assumptions quietly evaporate.
Meged’s interaction with vendors also highlights a worrying signal problem. Each time he reported a finding against Claude Code, Anthropic patched it and awarded a bounty, effectively redrawing the line around what counted as safe. “When the same researcher keeps breaking the same architectural seam from different angles, and each fix just moves the boundary to the next surface, the bounty-per-bypass model actually creates a perverse signal: it says ‘we consider this closed’ when the underlying exposure isn’t.” Google framed its own issue as an “Update to the Trust Model,” which is the right direction: this is a structural trust problem, not a string of isolated bugs. Treating these findings as patchable edges instead of a broken safety architecture leaves enterprises exposed to the same class of failure across vendors.
What Teams Must Do Now: Monitor the Handoff, Not Just the Model
If you deploy Claude Code, Gemini CLI, Codex, or similar agents for code generation and automation, you must assume their default safety protocols are incomplete. The model’s behavior and initial configuration are not your real boundary; the runtime harness is. Meged’s advice for teams running these agents in production is blunt: “Trace every path where the agent’s output, or any state the agent can influence, gets consumed by a later stage with different privileges.” Find where your harness says “this is safe” and ask what happens to that output next: is it published to a public channel, loaded as configuration for a high-privilege service, or passed to a tool with more access than the approval assumed?
Developers need to stop trusting labels and start validating at the point of consumption. A structural fix re-validates trust whenever data crosses privilege boundaries, not just when a command is first approved. That means restricted execution environments that isolate stages, runtime monitoring that inspects handoffs, and policies that treat agent-generated content as untrusted until proven otherwise. Enterprise AI agent threats are already active, with offensive operators using AI to automate exploitation across diverse infrastructure targets. If defenders keep focusing only on prompt safety while ignoring the workflow seams, they will lose. The takeaway is clear: your AI agents are safest when you assume their harness can fail and design your systems so that one “safe” step never becomes a silent exfiltration chain.
