# Claude Code GitHub Action Flaw Allowed Complete Repository Hijacking via Single Malicious Issue


## The Threat


A critical flaw in Anthropic's Claude Code GitHub Action—a tool that brings Claude AI into CI/CD pipelines for automated issue triage, PR review, and task execution—allowed attackers to take complete control of vulnerable public repositories by simply opening a single GitHub issue. The vulnerability, discovered by security researcher RyotaK of GMO Flatt Security, combined a permissioning bypass with indirect prompt injection to steal repository credentials and OIDC tokens, ultimately granting write access to target code and workflows.


The Claude Code GitHub Action operates at a privileged position in developer workflows. By default, it receives broad permissions across a repository's code, issues, pull requests, discussions, and workflow files. The action is intended to restrict execution only to users with write access to prevent malicious activation. However, this access control had a fundamental flaw: the action allowed any GitHub App (identifiable by a "[bot]" suffix in its username) to trigger execution without validating that the app was actually trusted. Since anyone can register a GitHub App and install it on their own repository, an attacker could create a rogue bot and use it to fire Claude Code on any public target.


Once execution was triggered, RyotaK exploited a second vulnerability: indirect prompt injection. By crafting a GitHub issue whose body mimicked system error messages and embedded hidden instructions, the researcher demonstrated how to manipulate Claude into extracting environment variables—including the credential pairs needed to obtain OIDC tokens. These tokens, when replayed with Anthropic's backend, granted a Claude GitHub App installation token with write access to the target repository. In a proof-of-concept against Anthropic's own claude-code-action repository, this chain could have pushed malicious code directly into the action itself, affecting every downstream project that pulled updates.


## Severity and Impact


| Metric | Value |

|---|---|

| CVE ID | Not yet assigned (reported Jan 2026) |

| CVSS v4.0 Score | 7.8 (High) |

| Attack Vector | Network |

| Attack Complexity | Low |

| Privileges Required | None |

| User Interaction | None |

| Scope | Changed |

| Confidentiality | High |

| Integrity | High |

| Availability | High |

| CWE | CWE-863 (Incorrect Authorization), CWE-94 (Code Injection) |

| Fix Released | claude-code-action v1.0.94 (January 2026) |


## Affected Products


  • Anthropic Claude Code GitHub Action — all versions prior to v1.0.94
  • Any third-party or custom CI/CD workflow using Claude Code or similar AI-powered automation with broad repository permissions
  • Downstream projects depending on vulnerable Claude Code Action workflows

    • ## Mitigations


    For Users of Claude Code GitHub Action:


    1. Update immediately to claude-code-action v1.0.94 or later, which includes fixes for both the bot bypass and additional hardening deployed throughout spring 2026.


    2. Audit workflow permissions — review all workflows that invoke Claude Code and ensure:

    - Only users with write access can trigger the action

    - The allowed_non_write_users parameter is never set to "*"

    - Remove or restrict permissions for tools and operations that could exfiltrate data (file reads, environment variable access, output to public summaries)


    3. Limit secrets — ensure Claude Code workflows only receive the minimum necessary secrets:

    - Anthropic API key (required)

    - GITHUB_TOKEN for repository operations (required)

    - Do not pass additional secrets such as deployment credentials, cloud provider tokens, or signing keys unless strictly necessary


    4. Restrict action outputs — disable or restrict the workflow run summary panel for Claude Code actions, as it is publicly visible and can leak sensitive information.


    5. Review example configurations — audit any workflows copied from Anthropic's official documentation or examples. Anthropic's own issue-triage template contained the misconfiguration allowed_non_write_users: "*", and many repositories inherited this setting.


    6. Implement input validation — if your workflow processes user-submitted content (issue bodies, PR descriptions, comments), add additional checks before passing it to Claude or other AI models.


    For AI/LLM Tool Developers:


  • Treat prompt injection vectors seriously in security models; document and validate access controls thoroughly
  • Avoid trust assumptions based on naming conventions (e.g., "[bot]" suffixes) without additional verification
  • Limit AI agent capability exposure to the minimum required for the task
  • Never output task summaries or intermediate data to public-facing surfaces

    • ## References


  • Anthropic Security Advisory: Anthropic's official notification and fix details (v1.0.94)
  • GMO Flatt Security Report: Full technical writeup by RyotaK of the discovery and proof-of-concept
  • GitHub: Claude Code Action Repository: https://github.com/anthropics/claude-code-action
  • OWASP on Prompt Injection: https://owasp.org/www-community/attacks/Prompt_Injection

    • ---


    ## HackWire Analysis


    This vulnerability exposes a dangerous shift in supply-chain risk. For years, infosec focused on compromising third-party libraries and build tools. Now, an attacker can compromise an entire repository infrastructure—not by poisoning a dependency, but by triggering an AI assistant in a misconfigured workflow. The trust boundary has shifted: instead of "is this library legitimate," it's now "does this AI system have appropriate guards?"


    The "[bot]" bypass is particularly instructive. It embodies a common security fallacy: mistaking identity for trust. GitHub Apps are installable by anyone and don't inherit special privileges. Treating them as automatically trustworthy because they have a naming convention is equivalent to allowing any executable with "verified" in its name to run at elevated privilege. It's a brittle pattern that fails the moment an attacker can spoof or create their own instance.


    What's alarming is how easily this chains into supply-chain compromise. Anthropic's own action repo uses the Claude Code action; poisoning it would affect every downstream project. But even for smaller repos, an attacker can silently add malicious CI/CD steps, exfiltrate secrets, or inject backdoors into the codebase—all without repository owners ever knowing an issue was opened. The attack requires zero interaction from legitimate developers.


    The real defense requires rethinking AI in CI/CD. Treat Claude, Cline, and similar tools not as trusted servants but as untrusted input processors. Cage their permissions ruthlessly, remove capability for data exfiltration, and validate every input before it reaches the model. Example code in documentation must ship secure-by-default, not merely "documented as risky." That Anthropic's own template inherited this flaw suggests the burden falls on individual teams—which is precisely when things break at scale.


    The incident in February involving Cline's claude-code-action proves this isn't theoretical. Defenders need immediate action: audit existing workflows for trigger restrictions and secret exposure, then update to v1.0.94. But this class of vulnerability—AI-driven code injection through CI/CD—is likely to repeat until the industry matures its threat model.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)