Organizations using Claude Code GitHub Actions should review their CI/CD environments after a researcher found vulnerabilities that could expose repositories to compromise and supply chain attacks.
The flaws, which have since been patched, allowed attackers to bypass permission controls and inject untrusted input into trusted workflows.
These vulnerabilities allow “… an attacker [to] bypass its permission controls and feed untrusted input into a workflow designed to process only trusted input,” said the researcher RyotaK in the analysis.
Key Takeaways
- Researchers discovered vulnerabilities in Anthropic’s Claude Code GitHub Actions workflow that could expose repositories to compromise and software supply chain attacks.
- A flaw in the workflow’s permission validation logic allowed attackers to bypass access controls and submit untrusted content that was treated as trusted input.
- Attackers could use prompt injection techniques to expose sensitive credentials, including GitHub Actions OIDC tokens, and potentially gain elevated access to repositories.
- The most severe attack scenario could have enabled malicious code to be introduced into Anthropic’s own claude-code-action repository, impacting downstream users.
- Organizations should upgrade to the latest Claude Code GitHub Actions version and review workflow permissions, secrets, and configurations for signs of exposure.
Breaking Down the Attack Chain
The vulnerabilities affected Anthropic’s official Claude Code GitHub Actions workflow, which enables organizations to integrate AI-assisted coding, issue management, and repository automation into CI/CD pipelines.
Because the workflow often operates with access to source code, pull requests, issues, workflow files, and repository secrets, a successful compromise could provide attackers with a foothold in development environments.
Depending on the permissions assigned to the workflow, threat actors could potentially modify code, access sensitive credentials, alter CI/CD processes, or gain broader access to connected systems.
According to the research, the most severe attack scenario involved Anthropic’s own claude-code-action repository, which relied on the vulnerable workflow.
If successfully exploited, an attacker could have injected malicious code into the action itself, creating a software supply chain risk that could impact any downstream repository relying on the software.
How the Permission Bypass Worked
The primary vulnerability stemmed from a flaw in the workflow’s permission validation logic.
While Claude Code GitHub Actions was designed to restrict execution to users with write or administrative repository access, the checkWritePermissions function automatically trusted any GitHub Action, regardless of its actual permissions.
As a result, attackers could create a malicious GitHub App and use its installation token to open issues or pull requests that the workflow incorrectly treated as trusted input.
Prompt Injection and Token Exposure Risks
Once the workflow processed attacker-controlled content, threat actors could leverage prompt injection techniques to manipulate Claude Code’s behavior.
Researchers demonstrated that specially crafted issue descriptions could trick the AI assistant into executing approved commands that exposed sensitive environment variables.
Among the most valuable targets were GitHub Actions OpenID Connect (OIDC) credentials, which could be used to obtain privileged authentication tokens and expand access within the repository environment.
Anthropic assigned the vulnerabilities a CVSS score of 7.8 and noted that some variants were actively exploited before public disclosure.
In a separate finding, the researcher discovered a misconfiguration involving allowed_non_write_users that could allow attackers to exfiltrate GitHub tokens and escalate privileges through workflow-chaining attacks.
Reducing Software Supply Chain Risk
Beyond applying updates, security teams should review workflow configurations, permissions, and secret management practices to identify potential weaknesses that could be exploited.
- Upgrade to the latest Claude Code GitHub Actions version and audit workflows for vulnerable configurations, including overly permissive allowed_non_write_users settings.
- Restrict GitHub Actions permissions, exposed secrets, and OIDC token access using least-privilege principles and limit credentials to only those required for workflow execution.
- Require manual approval for workflows triggered by external contributors before granting access to secrets, privileged actions, or sensitive repository resources.
- Implement branch protection rules, mandatory code reviews, and signed commits to reduce the risk of unauthorized code changes reaching production environments.
- Monitor workflow logs, token activity, repository changes, and CI/CD configurations for signs of credential exposure, unauthorized modifications, or data exfiltration attempts.
- Evaluate AI-assisted development tools for prompt injection risks and conduct regular security reviews of workflows, third-party actions, and automation integrations.
- Test incident response plans for CI/CD compromise, credential theft, and software supply chain attack scenarios to validate detection, containment, and recovery procedures.
Together, these measures can help reduce exposure to workflow-based attacks while strengthening the security of software development pipelines.
AI Development Risk
The Claude Code vulnerabilities underscore the importance of securing AI-powered development workflows that often operate with access to source code, repositories, and CI/CD infrastructure.
While prompt injection attacks are often associated with chatbots and AI assistants, this research demonstrates that similar techniques can also affect automation tools that interact directly with software development environments.
As organizations continue integrating AI into development processes, security teams should evaluate how these tools are authorized, what resources they can access, and how they may respond to untrusted input.
Zero trust solutions can help organizations reduce risk by limiting implicit trust, continuously validating access, and segmenting development environments to contain potential compromise.