Novee to reveal AI agent & Java flaws at Black Hat

Novee's researchers will present four security sessions on vulnerabilities affecting AI agents and enterprise Java systems, including findings involving products from Anthropic, Google and OpenAI.

The research examines attack paths in official AI workflows, coding sandboxes and middleware used in enterprise Java deployments. Novee says the work includes cases that can lead to remote code execution, secret exposure, policy bypass and supply chain compromise.

One Black Hat session focuses on trust failures inside AI agent workflows. Elad Meged, a founding team member and security researcher at Novee, is expected to outline how internal stages in tools including Anthropic's Claude Code, Google's Gemini CLI and OpenAI's Codex can treat attacker-influenced states as safe before passing them to components with greater authority.

In some instances, Novee says, this sequence led to remote code execution. Anthropic's own analysis said the exposure could affect "the runner's repository token and any workflow-injected secrets", while Google categorised the potential impact as "supply chain compromises."

The company argues that the risk lies not only in the model itself, but also in the surrounding software layer that translates model intent into actions. In automated environments, those components can operate without direct human review, creating gaps between validation and execution.

Java middleware

A second Black Hat session turns to enterprise Java platforms. Novee researchers Lidor Ben Shitrit and Assaf Levkovich are set to discuss pre-authentication remote code execution chains that move from exposed application programming interfaces to internal systems through middleware.

The research describes middleware that was not designed to process untrusted input but still becomes part of the attack path. The chains include unsafe deserialisation routes, permissive XStream configurations, an ObjectInputStream path without JEP-290 filtering, and a separate route involving token trust failures and Groovy evaluation.

The work highlights a familiar problem in enterprise software security: the weakness may lie not only at the front-end entry point, but also in the logic and tooling that pass data deeper into privileged systems. By framing middleware itself as the exploit route, the findings suggest some organisations may need to reassess assumptions about trusted internal processing.

Before prompts

At DEF CON, Meged is also expected to examine what Novee describes as pre-task remote code execution in Google's Gemini CLI. The attack surface, the company says, can appear before an AI model receives its first prompt, through configuration files, environment variables and other startup inputs.

Novee says these inputs may be trusted automatically in headless continuous integration and continuous delivery environments, allowing execution before sandbox controls begin. It described the flagship case as a deterministic exploit in Gemini CLI that Google scored at CVSS 10.0 and later patched.

The account matters because much of the public debate around AI security has focused on prompt injection and model manipulation. This research instead centres on software behaviour before prompt-time safeguards are active, widening the discussion from model safety to the mechanics of deployment and runtime configuration.

Sandbox limits

Another DEF CON session compares the containment approaches used by Claude Code, Gemini CLI and Codex CLI. Novee says each product relies on a structural assumption about runtime enforcement, and each can fail when actual execution paths do not match that assumption.

The session will argue that these failures stem from design gaps rather than model persuasion or prompt injection. That shifts attention to how security boundaries are implemented in practice rather than how the model is instructed.

Novee was founded by Ido Geffen, Gon Chalamish and Omer Ninburg, and says it focuses on AI penetration testing. It also says it has raised USD $51.5 million within four months of its inception from investors including YL Ventures, Canaan Partners and Zeev Ventures.

Geffen framed the findings as evidence that weaknesses can emerge in trusted layers of software before expected controls take effect. "These sessions show that some of the most serious security failures emerge before expected safeguards take effect, or inside components organisations already trust," said Ido Geffen, Chief Executive Officer and Co-Founder of Novee.

"By examining AI systems from Anthropic, Google and OpenAI alongside widely deployed enterprise Java platforms, our researchers are giving defenders practical ways to identify the same structural weaknesses across their own environments," Geffen said.