CVE-2026-12537: Gemini CLI 0.39.1 Fixes CI/CD Host Code Execution

Claude Code alternatives in 2026 differ by workflow​

TechRepublic's shortlist covers terminal-first agents, AI-native editors, cloud workers, pull-request automation and enterprise-managed deployments. Its criteria are reasonable. It asks whether an agent can inspect a codebase, edit several files, run tests and finish longer tasks. It also looks at how the agent learns project conventions, which models it supports, what automation hooks exist, and what security and enterprise controls sit around it.

Read the rankings as a map of workflows. The evidence doesn't show that any one tool is objectively best, and nobody here has run a like-for-like performance test. What the evidence does support is a split by the surface each product is built around:

A seat price is only part of the cost. Every vendor on this list now meters agent work through allowances, credits or usage pools, and a long agent task can use up a plan much faster than a chat session.

OpenAI Codex is the closest match to Claude Code, and it bills by the task​

TechRepublic names Codex the strongest general alternative because it covers both terminal and graphical use. It reads and changes repositories, runs commands and tests, reviews code, opens pull requests, and can run parallel tasks in separate worktrees and cloud environments. Skills let teams write down their standards, and background tasks handle jobs like issue triage and CI maintenance without an open interactive session.

OpenAI's own documentation adds detail for Windows users. Codex is a separate view inside the ChatGPT desktop app, and voice control works there on both macOS and Windows. Codex can't be selected on the ChatGPT website or in the mobile apps. The mobile app only gets a Remote tab for reaching supported desktop Codex chats. The newest model tier has a version floor: OpenAI says GPT-6 Astra needs Codex CLI 0.153.0 or newer, plus the latest desktop app.

Billing follows how you sign in. If you sign in with ChatGPT, Codex draws on your ChatGPT plan's usage. If you use your own API key, you pay API rates. OpenAI says the amount a task consumes depends on its complexity, input and output size, reasoning settings and Fast mode. Astra can drain an allowance faster than older models, and Plus and Business Standard seats get only limited Astra use before optional paid credits apply. So TechRepublic's shorthand "free, with higher limits on paid plans" is accurate at entry level but won't tell you your monthly spend.

Administrators get meaningful controls. ChatGPT workspace owners can turn Codex Local on or off per role, separately from the general-purpose Work agent. They can also set a starting model, reasoning level and Fast mode availability for Work and Codex. On the security side, TechRepublic reports that Codex sandboxes agents by default to the files and branches they are working on, and asks for approval before commands that need wider network or system access.

Google Antigravity CLI replaced Gemini CLI for individual users​

Google's change is the most important correction for anyone working from an older comparison. On May 19, 2026, Google announced Antigravity CLI as the new terminal client for its Antigravity agent platform and made it available to everyone that day. The Developers Blog post says it keeps Gemini CLI's most important features: Agent Skills, Hooks, Subagents and Extensions, which are now called Antigravity plugins. Google also admits there is no one-to-one feature parity at launch.

The new client is written in Go. It runs several agents in the background so a large refactor doesn't lock up the terminal, and it uses the same agent harness as the Antigravity 2.0 desktop app. TechRepublic adds that the free individual plan has basic weekly limits, and Google AI Pro raises them for $19.99 a month. Models aren't limited to Gemini: the current individual plan also includes Claude and other supported models.

The cutover date and its scope matter. On June 18, 2026, Gemini CLI and the Gemini Code Assist IDE extensions stopped serving requests for Google AI Pro and Ultra subscribers and for free Gemini Code Assist for individuals. Gemini Code Assist for GitHub stopped taking new installations on GitHub organizations that same day.

Enterprise customers stayed on the old tools. Google says organizations using Gemini CLI through Gemini Code Assist Standard or Enterprise licenses, or Code Assist for GitHub through Google Cloud, keep their access and updates. Gemini CLI also still works with paid Gemini and Gemini Enterprise Agent Platform API keys. So Gemini CLI hasn't been discontinued everywhere. It is still in production in enterprise pipelines, and that is why its security history, covered below, still matters.

GitHub Copilot's Windows app and Teams integration suit Microsoft shops​

For organizations that already keep code, issues and Actions on GitHub, Copilot covers the most ground. It spans IDEs, GitHub itself, a CLI, code review, cloud agents and a desktop app. GitHub also lets developers call third-party agents, including Claude Code and Codex, from inside its agent environment. TechRepublic lists Free with 2,000 completions a month, Pro at $10 a month, Business at $19 per user per month and Enterprise at $39.

GitHub's July 7, 2026 changelog opened the Copilot desktop app to every Copilot plan on Windows, macOS and Linux. Business and Enterprise users can't use it until an administrator enables Copilot CLI in policy settings. GitHub also lets people bring their own model-provider key without a Copilot subscription.

The Microsoft Teams integration goes further than "use Teams chats as context." Since August 21, 2026, mentioning @GitHub in a Teams channel, thread or direct message starts a Copilot cloud-agent session. Anyone in the conversation can add context or steer the work, but only people with write access to the repository can make Copilot change code. The agent runs asynchronously in a cloud sandbox, and its output can be picked up in the terminal, the Copilot app or an IDE. Repository admins can require an extra approval for any pull request attributed to the Teams integration identity. A repository that normally needs two approvals would then need three for these PRs.

The Teams feature is a public preview for paid plans only, and setup has several steps. In an organization, an admin must enable both Copilot cloud agent and cloud sandboxes. Then users install the GitHub app for Teams, connect their GitHub account, and set a default repository for public channels. Sessions use AI Credits, and cloud sandbox time is billed separately.

That billing point applies to Copilot as a whole. Since June 1, 2026, every Copilot plan has billed by GitHub AI Credits consumed. Each plan includes a monthly amount, and extra use is charged at month-end if a spending budget allows it. For private repositories, Copilot code review now also uses GitHub Actions minutes. Organizations and enterprises got user-level budgets that cap total AI Credit use, not only overage. In the same June notice, GitHub said new sign-ups for Student, Pro, Pro+ and the new Copilot Max tier were paused. The $10 Pro price is therefore where costs start for an agent-heavy user, not the whole bill.

Cursor and Kiro each ask teams to adopt a way of working​

Cursor puts the agent inside its own AI-native editor rather than adding one to an existing IDE. Cursor's official pricing page lists a free Hobby tier, Pro at $20 a month, Teams at $40 per user per month and custom Enterprise pricing. Pro includes agents, cloud agents, MCP integrations (Model Context Protocol connections to outside tools and data), skills and hooks. Teams adds central billing, usage analytics, team-wide privacy mode and SAML/OIDC single sign-on. Enterprise adds SCIM provisioning, pooled usage, audit logs, repository, model and MCP restrictions, and network and auto-run policies. TechRepublic also lists Pro+ at $60 and Ultra at $200, but those tiers weren't on the official pricing page consulted for this article, so check them before you budget.

The trade-off is obvious. Cursor pays off when developers are willing to make its editor their main workspace. If a team lives in a terminal or in GitHub's web interface, it loses most of what makes Cursor different.

Kiro, Amazon's entry, puts process ahead of prompts. Its Specs feature turns a request into requirements, a design document and a list of implementation tasks before the agent edits any code. Hooks trigger actions on events, such as running a linter after a file changes or blocking a tool call unless conditions are met. Steering files record project conventions. The same configuration works across Kiro's IDE, CLI and web versions. TechRepublic says the native iOS app is still in limited TestFlight early access for paid users.

Kiro's official pricing shows how its credits scale:

• The Free plan includes 50 credits.
• Pro costs $20 a month for 1,000 credits, and Pro+ costs $40 for 2,000.
• Pro Max costs $100 for 5,000 credits, and Power costs $200 for 10,000.
• On paid plans, extra credits cost $0.04 each, and usage per task depends on the task and the model chosen.

Kiro supports Anthropic, OpenAI and open-weight models, though availability depends on plan and region. A Kiro credit, a GitHub AI Credit and a Codex allowance all measure different things. You can only compare them by running your own workloads.

CVE-2026-12537 shows why CI/CD agents need isolation​

The largest practical risk in this category is automation. TechRepublic cites Cloud Security Alliance research tied to Black Hat USA 2026 that found separate CI/CD attack paths in Claude Code Action, Gemini CLI and OpenAI Codex workflows. Other reports credit the original disclosure to Novee Security. Exploit-intel describes it as three AI coding-agent harness vulnerabilities demonstrated on the vendors' own repositories running default configurations.

The Gemini CLI flaw is the most serious. In the NVD description, a malicious .gemini/.env file lets an attacker run code on the host of a headless CI platform before the sandbox starts. Affected versions are Google Gemini CLI (versions prior to 0.39.1) and run-gemini-cli GitHub Action (versions prior to 0.1.22). The cause, as Cybersecurity News explains it, was that the CLI automatically trusted workspace folders when running in non-interactive mode. This meant that configuration files, including environment variables stored in local directories such as .gemini/.env, were loaded without verification. Fixed releases are @google/gemini-cli 0.39.1 and 0.40.0-preview.3, as well as google-github-actions/run-gemini-cli 0.1.22, with all previous Action workflows being implicitly affected.

Severity scores for this CVE don't agree. The Hacker News reports a CVSS 4 score of 10.0. CyberStrike lists a CVSS 3.1 base score of 7.8 (HIGH). The difference comes from the scoring system, not from any disagreement about the flaw. Either way, pipelines running old versions need a patch. The CSA research note goes further: any pipeline run on an affected version that processed external or unreviewed pull-request content should be treated as possibly compromised.

The other two findings were handled differently. In Claude Code, CVE-2026-54316 turned Hugging Face's public download counter into an exfiltration channel that leaked an API key one character at a time, and is fixed in 2.1.163. Anthropic says exploitation required getting untrusted content into a Claude Code context. For Codex, The Hacker News confirms TechRepublic's account that the Codex finding produced neither a product-version patch nor a CVE. Novee says OpenAI's position is that its sandbox behaved exactly as documented. According to TechRepublic, the issue was a multi-pass workflow in OpenAI's own openai/codex repository. One agent pass could write attacker-controlled text into an instruction file that a later pass trusted, and OpenAI fixed it by splitting the passes into separate jobs.

The Codex case teaches the most. No version number fixes a pipeline design flaw. If one agent step can write something a later, more trusted step will read, patching the tool doesn't close the hole.

What this means for you​

Choose based on where your code and approvals already live. If you run CI agents, fix those pipelines before picking a new tool. Teams standardized on GitHub and Microsoft 365 get the most from Copilot, especially now that the desktop app runs on Windows and Teams chats can start cloud-agent sessions. Developers who want a single agent across terminal and desktop have the closest Claude Code match in Codex. People who used Gemini CLI on a personal Google AI plan have already been moved to Antigravity CLI, whether they chose to or not.

• Check every CI workflow that uses Gemini CLI or run-gemini-cli. Upgrade to Gemini CLI 0.39.1 (or 0.40.0-preview.3) and run-gemini-cli 0.1.22 or later, and look for workflows pinned to older versions.
• Upgrade Claude Code to 2.1.163 or later wherever it runs in automation.
• Budget Copilot by AI Credits, not seat price. Set user-level budgets for Business and Enterprise, and remember that code review on private repositories also uses Actions minutes.
• Before rolling out the Copilot desktop app to Business or Enterprise users on Windows, enable Copilot CLI in policy. If you pilot the Teams integration, consider requiring an extra approval on agent-created pull requests.
• In multi-step agent pipelines, give each step its own clean checkout and narrowly scoped credentials, and don't let untrusted issue or pull-request content reach a privileged agent job.
• Treat free tiers and credit counts as trial allowances. Run a realistic task on each shortlisted tool before you commit, because Codex usage, Kiro credits and Copilot AI Credits aren't comparable units.

By September 2026, the rival agents offer much the same core features: repository access, subagents, hooks, MCP and cloud execution. They now compete mainly on billing models, admin policy and how well they fit an existing toolchain. For Windows and Microsoft-centric teams, GitHub's run of releases this summer, from the cross-platform desktop app to Teams-started agent sessions and user-level budgets, has made Copilot the easiest option to govern. The same features that make these agents useful, such as running commands and opening pull requests without supervision, are what the Black Hat researchers exploited. Whichever tool you pick, set up the approval gates, budgets and isolated CI jobs before you give the agent more autonomy.