Claude Code GitHub Action Flaw Let One Malicious Issue Hijack Repositories
A security researcher discovered a flaw in Anthropic's Claude Code GitHub Action that allowed attackers to take over vulnerable public repositories by exploiting a permissive trigger check and prompt injection techniques. The vulnerability stemmed from the action's trust in GitHub Apps and the ability to inject commands through seemingly innocuous issue titles. This resulted in the theft of credentials and potential for malicious code injection into downstream projects, highlighting a broader issue of prompt injection vulnerabilities in AI coding agents.
The vulnerability was identified by RyotaK of GMO Flatt Security who reported a bypass in Anthropic's Claude Code GitHub Action in January. The core issue revolved around the action's trigger mechanism, which defaulted to granting read and write access to repositories, assuming the trigger was a trusted GitHub App. Attackers could exploit this by registering a GitHub App with write access and using it to open an issue, effectively bypassing the intended security controls. The vulnerability was patched within four days with further hardening.
The attack leveraged indirect prompt injection, crafting issue titles that would trick Claude into executing commands. Specifically, the attacker targeted the `/proc/self/environ` file to extract environment variables, including GitHub Actions credentials used to request an OIDC token. This token granted the attacker write access to the target repository, allowing them to modify code, issues, and workflows. A secondary vulnerability involved the Claude Code workflow posting task summaries to a publicly visible panel, providing a readily available data exfiltration route. The issue was compounded by the use of `allowed_non_write_users: '*'` in the example workflow, which allowed anyone to trigger the action.
This incident mirrors a real supply-chain attack where an attacker used a prompt-injected issue to steal an npm publish token and push an unauthorized version of Cline's software. The vulnerability has broader implications, with RyotaK reporting around 50 separate ways to bypass Claude Code's permission system, demonstrating a persistent problem with prompt injection in AI coding agents.