Critical Vulnerability in Claude Code GitHub Action Exposes CI/CD Secrets

Key Takeaways

• A critical vulnerability was discovered in Anthropic’s Claude Code GitHub Action, allowing attackers to exfiltrate CI/CD secrets.
• The flaw, tracked as a prompt injection vulnerability, could be exploited through seemingly innocuous GitHub issue comments or pull request descriptions.
• Successful exploitation grants unauthorized access to sensitive environment variables, including API keys, which could lead to workflow impersonation or deeper system access.
• Anthropic addressed the vulnerability in Claude Code version 2.1.128, released on May 5, 2026.

AI-Powered CI/CD Tool Vulnerable to Secret Exfiltration

The increasing integration of artificial intelligence into software development workflows, particularly within continuous integration and continuous delivery (CI/CD) pipelines, has dramatically enhanced efficiency. However, this advancement also introduces novel attack surfaces that malicious actors are quick to exploit. A recent disclosure highlights a significant vulnerability in a widely adopted AI coding assistant, demonstrating the potential for severe security compromises in automated development environments.

Security researchers have identified a critical flaw in Anthropic’s Claude Code GitHub Action, where AI-powered workflows can be manipulated via simple text inputs, such as comments on GitHub issues or pull request descriptions. This vulnerability, detailed in a report shared by Microsoft Threat Intelligence, allows for a sophisticated form of prompt injection. An attacker can craft a message that, while appearing harmless to a human, is interpreted as a direct command by the underlying AI agent, redirecting its intended operations.

The Mechanics of the Prompt Injection

Microsoft Threat Intelligence uncovered that the AI agent within the Claude Code GitHub Action could be coerced into reading sensitive environment files residing within the CI/CD runner. The core of the problem lies in an inconsistency in how the tool processes file access compared to command execution. Specifically, while the Bash tool operated within a secure sandbox that stripped environment variables, the Read tool did not enforce the same stringent security measures. This discrepancy created an exploitable pathway for attackers to access credentials that should have remained isolated within the system.

The consequences of such a vulnerability are substantial for organizations relying on automated AI workflows. A successfully exfiltrated API key could enable an attacker to impersonate the compromised workflow, consume valuable resources, or gain unauthorized access to interconnected systems. Following responsible disclosure by Microsoft, Anthropic promptly released a patch in Claude Code version 2.1.128 on May 5, 2026, to rectify the issue.

Evading Detection and Exfiltrating Secrets

Microsoft’s research team demonstrated the attack through a carefully constructed prompt injection. A malicious input, disguised as a “compliance review” request within a GitHub issue or pull request, was designed to bypass Claude’s inherent safety filters, which typically block explicit requests for sensitive data like API keys. By instructing the AI model to “trim the first seven characters” of the output, the attacker circumvented both the AI’s refusal mechanisms and GitHub’s Secret Scanner, preventing immediate detection of the exposed API key.

Once manipulated, the Read tool directly accessed /proc/self/environ within the runner’s process memory. This action revealed unscrubbed environment variables, including the critical ANTHROPIC_API_KEY and other credentials. The attacker could then reconstruct the full API key and exfiltrate it through various channels supported by the workflow, such as web requests, issue comments, or action logs. Microsoft categorized this attack chain under several MITRE ATLAS techniques, including LLM Prompt Injection, AI Agent Tool Invocation, LLM Jailbreak, and AI Agent Tool Credential Harvesting. Crucially, the exploit required no elevated privileges, only the ability to create a GitHub issue or submit a pull request.

What You Should Do

• Update Immediately: Ensure all instances of Anthropic’s Claude Code GitHub Action are updated to version 2.1.128 or later to patch this vulnerability.
• Implement “Agents Rule of Two”: Adhere to Microsoft’s recommendation that an AI workflow should never simultaneously process untrusted input, access sensitive secrets, and initiate external actions or modify system state. Limit workflows to two of these three capabilities.
• Apply Least Privilege: Enforce strict least-privilege principles for all tokens and API keys used in AI-powered workflows. Each key should be narrowly scoped to the exact permissions required for its specific task.
• Monitor API Key Usage: Actively monitor API key usage at the provider level for any anomalous activities, such as requests from new IP addresses or unusual endpoint calls. Configure alerts for such events to enable early detection of potential compromise.
• Harden System Prompts: Strengthen the system prompts of AI agents to clearly differentiate between trusted instructions and untrusted data inputs (e.g., issue bodies, pull request diffs). Explicitly state that all external content is untrusted.
• Pin Agent Tasks: Configure AI agents to perform single, well-defined tasks to minimize the risk of prompt injection manipulating them into unintended actions.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.