One GitHub Issue Was Enough to Pwn Repos Running Claude Code Action

Open an issue. Take the repo. That was roughly the attack path researcher RyotaK of GMO Flatt Security found in Anthropic's Claude Code GitHub Action, and it worked on any public repository running the workflow with default settings.

The primitive is familiar to anyone who has spent time in GitHub Actions security: untrusted input flowing into a privileged workflow. Issue bodies are attacker-controlled. The Claude Code Action ingested them, handed them to the model as instructions, and then executed model-suggested actions with the workflow's GitHub token. A sufficiently crafted issue could coax the action into running commands, writing files, or pushing commits back to the repo.

Call it prompt injection if you like. It's also just classic untrusted-input-to-shell, dressed up in an LLM costume. The same pattern that made pull_request_target infamous a few years ago is here again, with a language model standing in for the vulnerable parser.

The twist is the supply-chain angle. Anthropic's own action repository used the same vulnerable workflow. That means a working exploit wasn't just a one-shot against whichever indie project happened to wire Claude into its CI. An attacker who hijacked the upstream action could ship malicious changes that every downstream consumer would pull on their next run. The blast radius is every repo that pinned the action by a mutable tag rather than a commit SHA.

There's no public evidence the flaw was exploited in the wild before Anthropic patched it. RyotaK reported the issue through coordinated disclosure and Anthropic shipped fixes to the action. Users running it should update to the current release and, while they're in there, audit the permissions: block on any workflow that hands a GitHub token to a model.

A few takeaways worth chewing on.

LLM-driven CI is a new privilege boundary. If the model can call tools, the tools inherit whatever the workflow can do. Treating model output as trusted code execution is the same mistake as eval(user_input), and it deserves the same reflexive horror.

Pin actions by SHA. Tag-based pinning meant a compromise of the upstream repo would have propagated automatically. This is not a Claude problem; it's a GitHub Actions hygiene problem that the AI ecosystem keeps rediscovering.

And the boring lesson, again: the interesting part of an "AI attack" is usually not the AI. It's the plumbing around it.

RyotaK's writeup is here for the curious. Anthropic's advisory for the action lives on the project's GitHub releases page.