The weak point is the wrapper around the coding agent, not the model itself. In default GitHub-triggered workflows, untrusted issue text can reach code that runs with host or workflow authority before the sandbox or validation logic has a chance to stop it.
Novee Security showed that in Google Gemini CLI and Claude Code, a GitHub issue from an account with no repository privileges could reach CI runners, host command execution, or secret exposure in the vendors' default configs. Gemini CLI's CVE-2026-12537 is fixed in 0.39.1, run-gemini-cli in 0.1.22, and Claude Code's CVE-2026-54316 is fixed in 2.1.163; every Claude Code release from 0.2.54 through 2.1.163 is affected.
The pattern matters beyond these two CVEs. If outside users can trigger your agent workflow, the control point is the harness and its permissions, because patching the model does not change what the surrounding automation is allowed to do.