Claude Code GitHub Action Secret Exposure

Summary

The [Microsoft Defender Security Research Team](https://www.microsoft.com/en-us/security/blog/author/windows-defender-research/) demonstrated that Anthropic's [Claude Code GitHub Action](https://github.com/anthropics/claude-code-action) could expose CI/CD workflow secrets when processing GitHub content, such as issue bodies, pull request descriptions, and comments, containing prompt injections. The researchers analyzed the Claude Code Action codebase and obfuscated Claude Agent SDK to understand how agent tools executed and how GitHub events supplied content to the agent. They crafted a prompt framed as a compliance review that directed Claude to read a credential from its process environment, remove the credential prefix, and emit the transformed value. They introduced the prompt through attacker-controlled GitHub content processed by the lab workflow. The action fetched the malicious content into Claude's context, where it was interpreted as instructions. Claude invoked its Read tool against `/proc/self/environ`, returning the action process's unsanitized environment, including `ANTHROPIC_API_KEY`. Unlike Bash subprocesses, Read operations did not execute within the Bubblewrap sandbox and scrubbed-environment boundary. Removing the key's `sk-ant-` prefix allowed the output to bypass Claude's refusal behavior and GitHub's secret-pattern detection while remaining reconstructable by the researchers. Microsoft identified WebFetch, Bash, GitHub MCP, and GitHub Actions logs as potential additional exfiltration channels depending on workflow configuration. Microsoft disclosed the issue to Anthropic through HackerOne on April 29, 2026. Anthropic mitigated the vulnerability in Claude Code 2.1.128 on May 5, 2026, by blocking Read access to sensitive `/proc` files. Target: Claude Code GitHub Action Actor: Microsoft Defender Security Research Team Procedure: 1. The researchers analyzed the Claude Code Action codebase and the obfuscated Claude Agent SDK. They used the implementation details to understand how agent tools executed and where security boundaries were applied. 2. The researchers identified the tools available to Claude Code Action and compared their execution paths. They determined that Bash subprocesses could run within Bubblewrap with a scrubbed environment, while the built-in Read tool performed direct, in-process file access outside that isolation boundary. 3. The researchers identified that Claude Code Action could be triggered by GitHub events involving issues, pull requests, and comments and that the action would fetch the associated content into Claude's context. 4. The researchers crafted a prompt tailored to Claude Code Action framed as a compliance task that directed Claude to read a credential from its environment and emit it. 5. The researchers introduced the malicious prompt through attacker-controlled GitHub content processed by the lab workflow, modeling delivery through an issue body, pull request description, or comment handled by Claude Code Action. 6. Claude Code Action incorporated the malicious GitHub content into the model context. Claude interpreted the malicious content as instructions and followed the supplied instructions. 7. The prompt used benign compliance review framing and instructions to remove the credential prefix to bypass Claude's refusal behavior for emitting a recognizable API key. 8. Claude invoked its built-in Read tool on `/proc/self/environ`. Read did not execute within the Bubblewrap and scrubbed-environment boundary applied to Bash subprocesses.

Deployers

• Claude Code GitHub Action

Tags

• MITRE ATLAS
• AML.CS0067