Claude Code GitHub Action Flaws Exposed CI/CD Secrets and Enabled Repo Takeover

Researchers disclosed multiple security flaws in Anthropic’s Claude Code GitHub Action that could let attackers compromise public repositories and expose CI/CD secrets through a single malicious GitHub issue or other untrusted content. One issue, reported by RyotaK of GMO Flatt Security, stemmed from an authorization bypass that trusted any GitHub actor whose name ended in [bot], allowing attacker-controlled GitHub Apps to trigger workflows and inject malicious prompts. Anthropic said the bug could lead to disclosure of environment secrets, including credentials used to obtain OIDC tokens and Claude GitHub App installation tokens with write access, creating a path to repository takeover and broader supply-chain compromise.

Microsoft Threat Intelligence separately showed that Claude Code’s Read tool was not sandboxed like its Bash tool, enabling access to sensitive runner data such as /proc/self/environ and leakage of secrets including ANTHROPIC_API_KEY. In lab testing, Microsoft demonstrated prompt-injection attacks that bypassed model safeguards and GitHub secret scanning to exfiltrate credentials through logs, comments, or external channels. Anthropic fixed the authorization issue within days of disclosure and later added hardening in claude-code-action v1.0.94, while the /proc exposure was mitigated in Claude Code v2.1.128 by blocking access to sensitive procfs files; defenders were urged to treat AI-enabled CI/CD workflows processing untrusted issues, pull requests, and comments as high risk.