Claude Code: a single issue on GitHub could hijack any repository

It was enough to open a single issue on GitHub to take control of any public repository that used the GitHub Action of Claude Code. This is the integration with which Anthropic embeds its agent into CI/CD pipelines to route reports, apply labels, and review pull requests. RyotaK, a researcher at GMO Flatt Security, demonstrated this in an analysis published recently. The critical point is that the same workflow also ran in the official repository of the action: a successful attack could have injected code into the action itself and propagated it downstream to any project that incorporates it.

By default, the workflow receives read and write access to code, issues, pull requests, discussions, and workflow files of the repository, resulting in broad permissions, which is why the action should only allow those with write access. However, there was a flaw in the control.

A bot that no one installed

The function that verifies permissions unconditionally accepted any actor whose name ended in [bot], on the assumption that GitHub Apps are trusted tools installed by administrators. This assumption is evidently flawed, as anyone can register a GitHub App, install it on a repository they own, and use its token to open an issue on any public repository, even where the app is not installed. The action saw a bot and let the content through. The tag mode had an additional check to confirm that the actor was human; the agent mode lacked this, remaining exposed.

A vulnerability that made it possible to carry out a supply chain attack against Claude Code was disclosed!
https://t.co/ClcIk5n3Pk
— RyotaK (@ryotkak) June 1, 2026

Once the barriers were crossed, indirect prompt injection came into play, a technique that nests instructions within content that the model reads as data and ends up executing as commands. RyotaK crafted the body of an issue to resemble an error message: Claude, considering the read failed, tries to rectify by executing the hidden commands in the text. The target is /proc/self/environ, the Linux pseudo-file that exposes the environment variables of the process, including secrets. Claude Code blocks direct reads of that file, but the protection is circumvented, and the values end up rewritten in the issue, where the attacker can collect them.

Among those variables, the most valuable are the credentials with which GitHub Actions requests an OIDC token, the signed proof that certifies which workflow runs in which repository. Claude Code exchanges that token with Anthropic’s backend to obtain a write-access installation token for the GitHub App. Whoever steals the credentials can replay the exchange and end up with write access to the code, issues, and workflows of the target. Aimed against the action’s repository, the same mechanism could have poisoned the dependency that thousands of projects download downstream.

The shortcut of the sample configuration

RyotaK also reported an easier way, entirely bypassing the bot trick. The issue triage workflow distributed by Anthropic as an example came with the setting allowed_non_write_users: "*", allowing anyone to activate it: an option that Anthropic's documentation itself warns is risky. To make matters worse, Claude published the summary of completed activities on the public dashboard of the workflow execution, a ready-made exfiltration channel. Many repositories copied that example, inheriting the flaw.

The two configurations could then be concatenated. With write permission on issues obtained from the triage workflow, an attacker can modify a report from a trusted user after it has activated the workflow but before Claude reads it, inserting the payload as trusted input and achieving full compromise.

Variants of these incorrect configurations, RyotaK notes, had already been exploited before the publication. In February, a manipulated title issue against the triage workflow of Cline allowed the theft of an npm publication token and the upload of an unauthorized version, [email protected], withdrawn after about eight hours but managed to force the installation of a second agent, OpenClaw, on around 4,000 systems. In the same weeks, the autonomous bot HackerBot-Claw probed weak GitHub Actions configurations at Microsoft, Datadog, and CNCF projects, only to be rejected when it attempted to inject instructions into a Claude-based reviewer.

Anthropic fixed the bypass within four days of the January report, with further fortifications until spring: the fixes are in claude-code-action v1.0.94, the company assessed the vulnerabilities at 7.8 according to CVSS v4.0 and recognized a reward of $4,800. No CVE has been assigned according to available sources. Users of the action are left with the updating and auditing of workflows that allow users without write access or bots to operate, removing permissions and secrets that enable exfiltration. RyotaK reports having so far disclosed about fifty ways to circumvent Claude Code’s permission system: prompt injection is not a solved problem, and an agent with real tools and tokens can be pushed as far as its permissions allow.