Claude Code GitHub Action Secret Exposure via Prompt Injection
Claude Code GitHub Action
Researchers demonstrated that Anthropic's Claude Code GitHub Action could expose workflow secrets when processing GitHub content containing prompt injections. The vulnerability allowed agent tools to leak sensitive CI/CD data.
- first report
- 31 Jul 2026
- last update
- 31 Jul 2026
Timeline · 2
Sources · 2
Advisories and databases
- 2026-07-31Securing CI/CD in an agentic world: Claude Code Github action caseMicrosoft Security · microsoft.com/en-us/security/blog/2026/06/05/securing-ci-cd-in-agentic-world-cla
Research and catalogues
- 2026-07-31Claude Code GitHub Action Secret ExposureMITRE ATLAS · atlas.mitre.org/studies/AML.CS0067
Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.
Classification
- lane
- Research
- AI role
- Attack on AI
- categories
- Prompt injectionAgent hijackData leak
- severity
- 1 · Research / proof of concept
- targets
- Anthropic, Framework / tooling
- owasp llm top 10
- LLM01:2025 Prompt InjectionLLM02:2025 Sensitive Information DisclosureLLM06:2025 Excessive Agency
- dates
- happened 5 Jun 2026 · first reported 31 Jul 2026
- origin
- MITRE ATLASDerived from MITRE ATLAS (Apache 2.0, © MITRE).
- record
- confidence 0.95 · created 2026-10-18 06:55Z · updated 2026-10-18 06:55Z
Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned
Copy a brief
This record as a short Markdown brief, for a ticket, a chat or a coding agent.
the brief as text
# Claude Code GitHub Action Secret Exposure via Prompt Injection https://gcdradar.vercel.app/incidents/claude-code-github-action-secret-exposure-via-prompt-injecti · AIR-2026-0360 · closed 2026-08-14 - Lane: Research - Severity: 1 (Research / proof of concept) - Fix status: Fix status unknown - First reported: 2026-07-31 (happened 2026-06-05) - AI role: Attack on AI - Products: Claude Code GitHub Action ## Summary Researchers demonstrated that Anthropic's Claude Code GitHub Action could expose workflow secrets when processing GitHub content containing prompt injections. The vulnerability allowed agent tools to leak sensitive CI/CD data. ## What to do No action recorded; read the sources below and the vendor's advisory. ## Latest updates - 2026-07-31: Securing CI/CD in an agentic world: Claude Code Github action case (https://microsoft.com/en-us/security/blog/2026/06/05/securing-ci-cd-in-agentic-world-claude-code-github-action-case) - 2026-07-31: Claude Code GitHub Action Secret Exposure (https://atlas.mitre.org/studies/AML.CS0067) ## Sources - 2026-07-31 MITRE ATLAS: Claude Code GitHub Action Secret Exposure https://atlas.mitre.org/studies/AML.CS0067 - 2026-07-31 Microsoft Security: Securing CI/CD in an agentic world: Claude Code Github action case https://microsoft.com/en-us/security/blog/2026/06/05/securing-ci-cd-in-agentic-world-claude-code-github-action-case Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.
Related
- closedMCP SDKs Credential Exfiltration via Remote Poisoned MCP Tool
Research · since 1 Apr 2025
AI - closedCursor Data Exfiltration via MCP Server Prompt Injection Targeting Cursor
Research · since 24 Jun 2025
AI - closedClaude Code + SDKs Security Impact of Coding Agent's Memory Files
Research · since 30 Oct 2026
AI - closedMicrosoft 365 Copilot EchoLeak Zero-Click Prompt Injection on M365 Copilot
Research · since May 2025 (approx.)
AI - closedLenovo AI Chatbot Lena Cross-Site Scripting via Prompt Manipulation in Lenovo AI Chatbot
Research · since 18 Aug 2025
AI - closed9.5Flowise Flowise CSV Agent prompt injection leads to remote code execution
Patch now · Disclosed · since 4 Aug 2026 · CVE-2026-70477
AI