Novee CVE and Agent CI: Lessons for Plugin and Automation Repos Next to Bubble, Not for the App Runtime

A non-technical founder building an MVP on Bubble wants one thing: ship fast. Test the core value proposition, get feedback from the first users, land the first revenue or funding. In 2026 a lot of solo builders speed this up with vibecoding. AI coding agents write custom Bubble plugins, glue scripts, and background automation hosted in GitHub. Then Novee Security presented its findings at Black Hat USA, and AI agents wired into official repository workflows became a security headline. Same topic: Codex CLI Stable and the.

If you have no in-house security team, a headline that says "critical vulnerability" is hard to read calmly. So I'll go through the facts, explain why Bubble's hosted runtime is untouched, and list what I would actually check in the repositories around a Bubble app.

The Research: Novee's Black Hat 2026 Disclosure

On August 5, 2026, Elad Meged of Novee Security gave the briefing "Trusted Enough to Run: Breaking AI Agents in Official Workflows." He showed that unprivileged GitHub issues could trigger default CI/CD workflows on the vendor repositories for Anthropic Claude Code, Google Gemini CLI, and OpenAI Codex. By manipulating how the agent runs, an attacker could execute arbitrary commands on the CI runner, expose repository secrets, and compromise downstream pipelines.

The disclosure produced these tracked advisories:

• CVE-2026-54316 (Anthropic Claude Code): WebFetch and pre-approved domains (e.g., huggingface.co) allowed out-of-band exfiltration. The OSV record rates it CVSS v4 6.0 (Medium). Fixed in version 2.1.163.
• CVE-2026-12537 (Google Gemini CLI and google-github-actions/run-gemini-cli): Cloud Security Alliance and secondary analyses cite CVSS v4 10.0. Fixed in CLI version 0.39.1 and Action version 0.1.22.
• OpenAI Codex: Fixed through workflow architecture changes, no CVE. The change closed multi-pass instruction file manipulation patterns such as AGENTS.md.

The Cloud Security Alliance (CSA) noted that no confirmed in-the-wild exploitation had happened at the time of disclosure. The number I care about more: Novee found similar vulnerable default configurations in well over a hundred public repositories.

Why Bubble's Hosted Runtime Is Not Impacted

For a no-code founder, the key question is scope. No evidence links these CVEs or agent-CI patterns to Bubble's hosted SaaS platform or to plugin execution inside Bubble's infrastructure.

Bubble runs on a multi-tenant, hosted cloud engine. Your visual elements, database schema, server workflows, and native Bubble plugins run inside Bubble's controlled perimeter. Novee's findings are about developer CI/CD runner environments on GitHub Actions that execute CLI agent binaries. They are not about web apps running on Bubble. Same topic: Plugin4Shell and the vibe-coded audit.

Where the Real Risk Exists: Adjacent Repositories

The risk for solo builders and vibecoders is in the tooling around the app. When you extend Bubble, you might:

1. Maintain an open-source or private GitHub repository for a custom Bubble plugin.
2. Write webhook handlers or microservices (Node.js/Python) that connect Bubble to third-party APIs.
3. Set up automated GitHub Actions where an AI coding agent triages issues, tries to reproduce reported bugs, or opens pull requests on its own.

Novee showed how 'trust handoffs' break down inside these agent harnesses:

• Someone untrusted submits a crafted GitHub issue.
• The workflow starts an AI agent inside a runner that holds repository secrets (GITHUB_TOKEN, Stripe keys, or Bubble Data API bearer tokens).
• The agent treats the issue text as authorized project context, runs the malicious instructions, or sends environment variables out-of-band.

If your CI runner can reach your production Bubble API keys, a compromised pipeline means compromised live app data. Bubble has no flaw here. The flaw is a workflow with too many permissions.

Actionable Checklist for Solo Builders

This is what I do to move fast without opening avoidable supply-chain holes:

1. Upgrade agent tools. If your pipelines call Claude Code or Gemini CLI, make sure you are on the patched releases or later: Claude Code 2.1.163, Gemini CLI 0.39.1, and run-gemini-cli 0.1.22.
2. Turn off unauthenticated public triggers. Never let AI agent actions run automatically on public issues: [opened], issue_comment, or untrusted fork PR events.
3. Give secrets the least privilege. Keep production Bubble API keys, database credentials, and payment secrets out of CI workflows meant for code generation or linting.
4. Keep vibecoding supervised. I run AI coding assistants locally on my workstation or in interactive sessions where I read the generated diffs before merging. I don't give CI bots the right to commit and deploy on their own.
5. Don't rely on prompt defenses. A system prompt guard like "do not reveal keys" is not a deterministic security barrier. Real isolation comes from least-privilege tokens and workspace sandboxing. Worth reading next: Why You Don't Need ai.

AI tools are fine to use on an MVP. Just keep the Bubble app on one side, the Git automation on the other, and give every runner only the keys it can't work without.