Claude Code's critical failure: when opening an issue gives you full control of your repositories in GitHub Actions

A security researcher, RyotaK of GMO Flatt Security, discovered a critical vulnerability in the Anthropic GitHub Action called Claude Code that allowed an attacker to take control of vulnerable public repositories with nothing more than opening an issue: the action could rely on "bots" without validating its origin and, combined with prompt injection techniques, lead to the exfiltration of credentials and the taking of the flow of CI / CD.

In technical terms, the action is designed to be integrated into CI / CD pipelines and has by default extensive permissions on code, issues, pull requests and workflow files. To mitigate this risk, action should restrict who could shoot it, ideally only users with writing permits. The ruling was in a check that allowed any actor whose name ended in [bot] under the wrong assumption that the GitHub Apps are intrinsically reliable. However, anyone can create and install a GitHub App in their own repository and use their token to interact with other public repositories; the action interpreted that interaction as "bot of trust" and accepted the malicious content.

Once the action accepts adversary content, the attacker can use prompt injection, i.e. insert instructions in the text that the model (Claude) interprets as part of its task. RyotaK demonstrated how to get Claude to read and write in a way that would filter environment variables from / proc / self / environ - where they can reside secrets - and that those variables would include the chain needed to get a GitHub App installation token with writing permissions. This token can be exchanged for access to the action and therefore allow the injection of malicious code in the action itself that then spreads to projects that consume it.

Anthropic received the report in January, rated the series of failures with a V4.0 CVSS 7.8, corrected the central bypass in four days and published additional hardening during the spring; the corrections are included from claude-code-action v1.0.94. Anthropic also paid a reward for the finding. Even so, RyotaK confirmed approximately 50 different vectors to avoid the permit system, which underlines that the problem is both technical and design: agents with tools and credentials can be pushed as far as their permissions allow.

The implications are far-reaching. Many organizations replicate examples of workflows such as and inherit bad configurations, such as the option allowed _ non _ write _ users: "*," which allows any user to trigger the action. In addition, the practice of publishing summaries or IA outputs on public panels of workflow executions creates additional escape channels. There are already real precedents: in February, a prompt injection into a triage flow allowed to steal a npm publication token and upload an unauthorized package, a clear example of how a broken chain of trust can convert a development assistant into supply-chain vectors.

If you administer repositories using Claude Code or other IA actions, the first and most urgent recommendation is update to claude-code-action v1.0.94 or more. Then check and tighten your workflows: restrict who can shoot them, do not accept triggers of unreliable or generic actors with [bot] without additional verification, and avoid the configuration that allows users without writing permits to activate critical actions. It limits the permits of GITHUB _ TOKEN and any tool to what is strictly necessary and avoids exposing summaries or exits of agents on public panels or artifacts that can be read by attackers.

It is also critical to think about design: do not feed an agent with unreliable inputs when you have access to secrets or writing permits. If you need to process public contributions, implement a sanitization and manual approval stage before an agent has access to sensitive tokens; use approval controls for external taxpayer workflows and restrict the use of tools that can be written in the repository or published packages. It applies the philosophy of less privilege and the principle of separation of functions between automatic review and actions that alter artifacts or secrets.

For those who want to deepen how to harden GitHub Actions and mitigate such vectors, GitHub's official documentation on security for Actions is a basic and useful resource: https: / / docs.github.com / en / actions / learn-github-actions / security-hardening-for-github-actions. It is also recommended to review the Anthropic repository and its versions of the action directly to verify the update: https: / / github.com / anthropic / claude-code-action.

The Claude Code case is not an isolated curiosity but another evidence that Prompt injection defenses and CI / CD permit design remain immature areas. Security and development teams should treat IA actions as components of the supply chain: deploy them with caution, audit their permits, require human reviews for unreliable inputs and apply monitoring for abnormal behavior detection. Meanwhile, agent providers must assume that potentially malicious data will reach their models and design technical, policy and use barriers that minimize damage if these barriers are violated.