Prompt injection in Claude Code GitHub Action exposes workflow secrets

Affected Systems

Anthropic's Claude Code GitHub Action (prior to mitigation). Affects GitHub workflows using the action with access to repository secrets. Vulnerability exploitable when action processes untrusted input from pull requests or external sources.

Exploitation Status

No active exploitation reported. Vulnerability disclosed responsibly by Microsoft Threat Intelligence. Anthropic has implemented mitigations. No public PoC available, but attack chain documented in research.

Business Impact

Organizations using Claude Code GitHub Action in CI/CD pipelines risk exposure of workflow secrets (API keys, credentials, tokens) through prompt injection attacks. Attackers could craft malicious inputs in pull requests to manipulate the AI agent into leaking secrets. Impact limited to workflows that grant the action access to sensitive secrets and process untrusted input. No CVE assigned yet.

Urgency

🟡 Within a week

Recommended Actions

• Audit GitHub workflows using Claude Code GitHub Action for access to sensitive secrets and untrusted input processing
• Update to latest version of Claude Code GitHub Action with Anthropic's security mitigations applied
• Implement least-privilege access for GitHub Actions secrets—avoid exposing credentials to AI-powered actions unless required
• Review GitHub Actions logs for Claude Code action usage and inspect for anomalous secret access patterns
• Consider restricting Claude Code action usage to trusted branches only, blocking execution on external pull requests