VulnerabilitiesJun 5, 2026

Securing CI/CD in an agentic world: Claude Code Github action case

Microsoft discovers prompt injection vulnerability in Claude Code GitHub Action allowing CI/CD workflow secret access.

Microsoft Threat Intelligence identified a prompt injection vulnerability in Anthropic's Claude Code GitHub Action that could expose CI/CD workflow secrets when AI agents process untrusted GitHub content (issue bodies, PRs, comments). The vulnerability allowed the Read tool to access /proc/self/environ, exposing the ANTHROPIC_API_KEY and other credentials. Anthropic mitigated the issue in version 2.1.128 by blocking access to sensitive /proc files, and Microsoft provides guidance for securing AI-powered CI/CD workflows against similar attacks.

AI summary of the linked source. Not reviewed by an editor. How this works

Read at source

Vendor Watch

Run Microsoft?

Get an email when a new story names Microsoft, usually within the hour.

Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch works Privacy

The lesson from this incident

Full lesson

A prompt injection vulnerability in Anthropic's Claude Code GitHub Action allowed attackers to manipulate AI agents into reading sensitive environment variables and exposing CI/CD secrets like API keys. The vulnerability exploited the AI tool's file reading capabilities to access /proc/self/environ, demonstrating how AI agents can be tricked into performing unintended actions when processing untrusted input. This incident highlights the critical need to secure AI-powered development tools and treat them as potential attack vectors in the software supply chain. Organizations using AI agents in CI/CD pipelines must implement strict access controls and input validation to prevent similar exposures.

What helps against this

How we list vendors

Microsoft research

Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
For exampleWALLIX PAM BeyondTrust Password Safe Palo Alto Networks Idira Privileged Access Management all options
Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
For exampleHashiCorp Vault Palo Alto Networks Idira Secrets Management GitHub Advanced Security all options
AI application security
Prompt injection, data leaks through AI tools and unapproved AI use get caught.
For exampleHiddenLayer AI Security Platform Boomi AI Gateway Palo Alto Networks Prisma AIRS all options

Indicators of Compromise

Extracted by AI from the linked source. Not reviewed by an editor. How this works

mitre_attack — T1005 - Data from Local System
mitre_attack — T1059 - Command and Scripting Interpreter
mitre_attack — T1570 - Lateral Tool Transfer

Entities

Anthropic (vendor)Microsoft (vendor)Claude Code GitHub Action (product)GitHub Actions (technology)Prompt Injection (technology)