Critical Vulnerability in Claude Code GitHub Action Exposes CI/CD Secrets

Summary

Security researchers have identified a critical security vulnerability (CVSS v4.0: 7.8) in Anthropic’s Claude Code GitHub Action. The flaw allowed unauthorized actors to bypass authentication checks and leverage indirect prompt injection attacks to read sensitive environment variables, such as the ANTHROPIC_API_KEY, and potentially compromise downstream repositories. Anthropic has released patches addressing these issues in claude-code-action v1.0.94 and Claude Code v2.1.128.

What happened?

Security researcher RyotaK of GMO Flatt Security and threat analysts at Microsoft Threat Intelligence discovered two chainable vulnerabilities in the Claude Code GitHub Action:

Authorization Bypass: The checkWritePermissions function in the Claude Code GitHub Action was intended to verify that only authorized repository contributors could trigger the agent. However, a logic error caused it to unconditionally trust any GitHub actor whose name ended in [bot]. Attackers could exploit this by creating a malicious GitHub App, installing it on a repository under their control, and using it to open an issue or pull request in the target repository. Because the actor was flagged as a bot, the validation check was bypassed.
Credential Exposure via Read Tool: Microsoft Threat Intelligence discovered that Claude Code’s file-reading tool was not properly sandboxed, permitting access to sensitive system paths such as /proc/self/environ.

When combined, these issues allowed an attacker to submit a malicious GitHub issue containing indirect prompt injections. Once triggered, the AI agent executed instructions to read /proc/self/environ using its read tool, exposing and exfiltrating environment secrets to the attacker.

Why it matters

Integrating autonomous AI agents into CI/CD software development pipelines introduces novel security vectors. Because agents often possess elevated system permissions and parse untrusted external inputs (such as issue descriptions or comments), they are prime targets for indirect prompt injections. A single successful exploit can compromise the entire software supply chain if deployment tokens, cloud credentials, or API keys are exfiltrated.

Evidence

Vulnerability Patching: The authentication flaw was addressed by correcting the bot validation logic in the checkWritePermissions function.
Proof of Concept: Security researchers successfully demonstrated a proof of concept where an untrusted bot actor opened an issue containing prompt injection instructions, prompting Claude to read /proc/self/environ and expose the API key.
Official Security Advisories: Anthropic patched the Claude Code GitHub Action (v1.0.94+) and hardened the file-reading tool within Claude Code (v2.1.128+) to block access to system-level configuration files.

Analysis

This incident underscores the risk of “privilege escalation via trusted interfaces.” AI agents frequently act as high-privilege intermediaries. If the authentication layer governing the agent fails—for example, by blanket-trusting bot entities—the security perimeter collapses entirely. Furthermore, this highlights that traditional application sandboxing must be adapted for AI tools: an agent should never be granted unrestricted access to the host’s runtime environment or raw system files.

Practical Takeaways

Developers and administrators using Claude Code should take the following steps immediately:

Upgrade Immediately: Ensure the Claude Code GitHub Action is updated to version v1.0.94 or later, and the Claude Code CLI tool is upgraded to v2.1.128 or later.
Apply Least Privilege: Restrict the permissions of CI/CD workflows running AI agents (e.g., set permissions to contents: read unless write access is strictly necessary).
Input Sanitization and Isolation: Treat all external inputs (issues, comments, PR descriptions) as untrusted. Run AI agents in isolated, short-lived ephemeral environments without access to production credentials.

Open Questions

How many repositories were vulnerable or compromised prior to the deployment of these patches?
What standardized runtime constraints can be developed to prevent AI agents from using system-level tools against their own hosting infrastructure in response to prompt injections?