Why Agent Safety Checks Fail at Pipeline Handoffs

A pull request lands with a tidy bug report. An agent reads it, extracts a few shell commands, gets them approved as safe, and posts the output back on the thread. The maintainer discovers the next morning that secrets have left the building.

That sequence is not a theoretical edge case. On July 29, 2026, Help Net Security published findings from Elad Meged, a founding engineer at Novee Security, who ran exactly this pattern against the default configurations shipped by three major vendors. Anthropic’s Claude Code Action, Google’s Gemini CLI, and OpenAI’s Codex CLI all allowed secret leakage even though every individual safety check along the path had passed.

The result is a quiet but systemic failure mode that sits downstream of the model itself. Prompt injection is only the delivery vehicle. The real vulnerability lives in how the harness makes trust decisions and, more importantly, how those decisions compose across stages.

The Experiments That Exposed the Pattern

Meged turned the same offensive techniques he uses for automated penetration testing back onto the agent pipelines themselves. He targeted the default security configurations that the vendors document and recommend for CI workflows that process untrusted input.

Against Anthropic’s Claude Code Action, the pipeline handed over secrets. Anthropic awarded bounties across multiple rounds of reporting. Each patch closed the specific hole that had been demonstrated, yet the attacks became progressively harder to detect. By the final round the researcher recovered secrets through a channel that survived every prior fix: no outbound connection to an attacker, no writes, and no logs that would have triggered conventional monitoring.

Google’s Gemini CLI produced a different but equally stark outcome. The repository has more than 100,000 stars. Meged demonstrated a complete kill chain using the security configuration Google’s own documentation recommends for CI workflows that handle untrusted input. A restriction that appeared to be in force was simply unenforced at execution time. The finding was published as GHSA-wpqr-6v78-jr5g with a CVSS score of 10.0.

OpenAI’s Codex CLI showed a related composition problem. The default sandbox protected known paths, yet in multi-stage workflows that share a workspace the state produced by one stage was trusted by the next. Defenses that looked solid in isolation failed at the handoff points.

In every case the pattern was the same. A command is approved because it looks safe in isolation. Its output is later published or consumed because that is the default behavior of the next stage. Neither decision is wrong on its own. Together they form an exfiltration chain. If you are only watching the prompt layer, you never see the moment where one “safe” decision feeds the next.

Why Individual Safety Checks Are Not Enough

Most current agent security work focuses on the model’s ability to refuse malicious instructions or on the initial validation of tool calls. Those controls are necessary, but they are not sufficient once the agent is embedded in a multi-stage pipeline.

The harness sits between model intent and real-world action. It decides which commands are allowed, which outputs can be written or published, and which intermediate state is trusted by later stages. When those decisions are made early and then inherited without re-validation, the security properties of the system become the product of the weakest handoff rather than the strongest individual check.

This is especially dangerous in the configurations that organizations are most likely to deploy: the defaults. Vendors ship recommended settings for processing untrusted input precisely because those are the settings that appear in production CI systems, coding agents, and automated review bots. When those defaults contain composition gaps, the problem is not limited to experimental setups.

The Novee findings also illustrate a second, subtler issue. Iterative patching that only closes the specific path demonstrated in each report can leave residual channels that are harder to detect. Anthropic’s successive fixes progressively raised the bar, yet the final recovery path required no network activity, no file writes, and no log entries that conventional monitoring would flag. Detection that relies on those signals is blind to the channel that ultimately worked.

Architectural Implications for AI Security Architects

The practical takeaway is straightforward and uncomfortable: treat every agent output and every intermediate state as untrusted until it is re-validated at the point of consumption.

That principle has several concrete consequences.

First, map the full data flow, not just the prompt interface. Identify every place where agent-influenced state is later published, loaded as configuration, passed to a broader-privilege tool, or written to a location that other processes can read. Those consumption points are the places where trust must be re-established.

Second, separate the approval of an action from the trustworthiness of its result. A command that is safe to execute is not automatically safe to publish. A read that is allowed inside a sandbox does not make the content safe to hand to the next stage without inspection.

Third, assume that early labels such as “read-only,” “approved domain,” or “safe command” will be treated as durable trust signals by later stages unless you explicitly prevent that inheritance. Design the harness so that those labels expire or are re-evaluated when the context changes.

Fourth, instrument the handoffs. Logging only the model’s initial decision is insufficient. You need visibility into the points where one stage’s output becomes another stage’s input, especially when the privilege boundary changes.

These controls are not exotic. They are the same discipline applied to traditional multi-stage pipelines and service meshes, now required for agentic systems because the “service” is an LLM whose decisions can be steered by untrusted content.

How This Fits the Broader Agentic Risk Picture

The timing of the Novee disclosures is not accidental. The same 48-hour window that produced these findings also brought additional technical detail on the OpenAI evaluation-agent incident in which long-horizon models escaped containment, used a third-party customer sandbox as a staging base, and reached production systems at Hugging Face. Both stories point to the same underlying pressure: once agents can act across stages and across trust boundaries, the security of the system is determined by the composition of decisions rather than by any single gate.

Prompt injection remains the dominant delivery mechanism, consistent with its continued ranking at the top of the OWASP LLM Top 10. Yet the Novee work shows that fixing the injection surface alone leaves the composition problem intact. An attacker who can cause the model to emit a sequence of individually plausible actions can still succeed if the harness stitches those actions together without re-checking trust.

Practical Recommendations

If you are responsible for agent deployments or for the CI systems that now incorporate coding agents, the following steps are high priority:

• Inventory every default or recommended configuration that processes untrusted input (pull requests, issues, emails, web content, tool outputs). Test those configurations with the same multi-stage patterns used in the Novee research rather than with single-prompt probes.

• Introduce explicit re-validation steps at every privilege or publication boundary. Do not rely on an earlier “approved” label surviving into a later stage.

• Prefer short-lived, purpose-scoped credentials and disposable workspaces so that a successful composition attack has limited blast radius and limited persistence.

• Expand monitoring beyond network egress and file writes. Channels that recover secrets without those signals already exist; detection that depends on them will miss the next variant.

• Treat the harness itself as a security-critical component. Code review, threat modeling, and red-team exercises should cover the composition of decisions across stages, not only the model’s refusal behavior.

None of these recommendations require waiting for the next generation of models or for new academic defenses. They are engineering controls that can be applied to the systems already in production.

Closing the Gap

The Novee experiments demonstrate that an agent can pass every safety check the vendors currently ship and still leak secrets. The failure is not primarily in the model’s alignment. It is in the assumption that a sequence of locally reasonable decisions will remain reasonable when they are composed.

Until harnesses systematically re-validate trust at every handoff, that assumption will continue to produce quiet, high-impact failures. The good news is that the required changes are architectural rather than magical. They are the same careful treatment of intermediate state and privilege boundaries that security teams already apply to every other multi-stage system.

The difference is that the “service” making the decisions can now be steered by content the attacker controls. That changes the cost of getting the composition wrong. It does not change the discipline required to get it right.