Anthropic Claude Code Vulnerability Exposes CI/CD Pipeline Risks

A critical security vulnerability in Anthropic’s Claude Code GitHub Action allowed attackers to compromise public repositories by exploiting a flaw in how the agent verified user permissions. RyotaK, a security researcher at GMO Flatt Security, identified that the action incorrectly trusted any GitHub App whose name ended in the suffix bot, granting them unauthorized access to repository resources.

The vulnerability stemmed from an overly permissive trigger mechanism that failed to distinguish between legitimate administrative bots and malicious actors. By registering a custom GitHub App and installing it on a public repository, an attacker could bypass standard security checks to execute commands within the CI/CD environment. This flaw effectively granted the attacker the same read and write permissions assigned to the Claude Code agent, including access to sensitive workflow files and repository secrets.

The attack vector relied on indirect prompt injection, where malicious instructions were embedded within a GitHub issue to manipulate the AI model’s behavior. RyotaK demonstrated that Claude could be coerced into reading environment variables, such as the credentials used to request OIDC tokens, by interpreting the injected text as an error recovery task. These tokens provided the necessary authentication to perform unauthorized actions, including the potential to poison the action itself and propagate malicious code to downstream projects.

Anthropic addressed the vulnerability in January, implementing fixes within four days and further hardening the codebase in subsequent releases. The company rated the issue 7.8 under CVSS v4.0 and issued a bug bounty to the researcher for the discovery. Users are advised to update to claude-code-action v1.0.94 or later to mitigate the risk of unauthorized command execution.

The technical mechanism for this exploit involved the manipulation of the /proc/self/environ file, which contains critical process environment variables. By bypassing the agent’s internal guardrails, the attacker forced the model to output these variables directly into a publicly visible issue comment. This data exfiltration provided the attacker with the necessary credential pair to request a signed OIDC token, which is the primary mechanism for proving the identity of a workflow running within a specific repository.

Once the attacker obtained the OIDC token, they could trade it with the Anthropic backend for a Claude GitHub App installation token. This token granted the attacker full write access to the target repository, enabling them to modify code, manage issues, and alter workflow configurations. This chain of events demonstrates how a single, seemingly benign GitHub issue can be leveraged to achieve full administrative control over a CI/CD pipeline.

The Cline repository incident in February demonstrated how prompt injection could lead to the theft of npm publish tokens and the distribution of unauthorized package versions. Attackers used a poisoned issue title to trigger the triage workflow, which then allowed them to exfiltrate credentials and push a malicious update to the package registry. These events indicate that prompt injection remains an unsolved challenge for autonomous agents integrated into development infrastructure.

Security leaders must audit their current CI/CD configurations to identify any workflows that permit untrusted input to interact with AI agents. Restricting the scope of accessible secrets and removing unnecessary tools from the agent’s environment are essential steps for maintaining a secure posture. Monitoring for anomalous activity in workflow logs remains a critical requirement for detecting potential exploitation attempts.

The persistence of these vulnerabilities suggests that AI agents will continue to be a primary target for attackers seeking to compromise development environments. Future security strategies should prioritize the isolation of AI agents from sensitive credential stores and the implementation of strict input sanitization protocols. Organizations should anticipate further scrutiny of AI-driven automation as these tools become more deeply embedded in enterprise software delivery cycles.