[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fAkYLLskPekteRu9HhNaQotE93t7zCnXnzdps87v50zY":3},{"article":4,"iocs":56,"watch_terms":67,"solutions":68,"lesson":156},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"c5cb0a32-c14f-4654-873f-a43e5d15b6d0","Securing CI\u002FCD in an agentic world: Claude Code Github action case","securing-ci-cd-in-an-agentic-world-claude-code-github-action-case-84cc70","Microsoft Threat Intelligence identified a prompt injection pathway in Claude Code GitHub Action that allowed access to workflow secrets under specific conditions. This research examines the attack chain, responsible disclosure process, Anthropic's mitigation, and guidance for securing AI-powered CI\u002FCD workflows. The post Securing CI\u002FCD in an agentic world: Claude Code Github action case appeared first on Microsoft Security Blog.","Microsoft Threat Intelligence identified a prompt injection vulnerability in Anthropic's Claude Code GitHub Action that could expose CI\u002FCD workflow secrets when AI agents process untrusted GitHub content (issue bodies, PRs, comments). The vulnerability allowed the Read tool to access \u002Fproc\u002Fself\u002Fenviron, exposing the ANTHROPIC_API_KEY and other credentials. Anthropic mitigated the issue in version 2.1.128 by blocking access to sensitive \u002Fproc files, and Microsoft provides guidance for securing AI-powered CI\u002FCD workflows against similar attacks.","Microsoft discovers prompt injection vulnerability in Claude Code GitHub Action allowing CI\u002FCD workflow secret access.","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F06\u002F05\u002Fsecuring-ci-cd-in-agentic-world-claude-code-github-action-case\u002F","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002Fwp-content\u002Fuploads\u002F2026\u002F03\u002FMS_Actional-Insights_AI-agents.jpg","2026-06-05T16:46:47+00:00","2026-06-05T18:00:10.925188+00:00",9,[17,20,22,25,28],{"name":18,"type":19},"Anthropic","vendor",{"name":21,"type":19},"Microsoft",{"name":23,"type":24},"Claude Code GitHub Action","product",{"name":26,"type":27},"GitHub Actions","technology",{"name":29,"type":27},"Prompt Injection","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":32,"name":33,"slug":34},null,"Vulnerabilities","vulnerabilities",[36,41,46,51],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":52},{"id":53,"icon":32,"name":54,"slug":55},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",[57,61,64],{"type":58,"value":59,"context":60},"mitre_attack","T1005 - Data from Local System","Unauthorized read of workflow environment variables containing secrets",{"type":58,"value":62,"context":63},"T1059 - Command and Scripting Interpreter","AI agent executing commands via natural language instruction",{"type":58,"value":65,"context":66},"T1570 - Lateral Tool Transfer","XSS payload injection into repository files via AI-assisted workflow",[21,18,23],{"controls":69,"vendors":150},[70,99,125],{"slug":71,"name":72,"problem":73,"products":74},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[75,83,91],{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"slug":100,"name":101,"problem":102,"products":103},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[104,112,117],{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":113,"product_name":114,"url":115,"description":116},"idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"slug":50,"name":126,"problem":127,"products":128},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[129,137,145],{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"hiddenlayer","HiddenLayer","\u002Fvendor-logos\u002Fhiddenlayer.png","hiddenlayer-ai-security","HiddenLayer AI Security Platform","https:\u002F\u002Fhiddenlayer.com\u002F","Model scanning, AI red teaming and runtime protection for AI applications.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-ai-gateway","Boomi AI Gateway","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fai-gateway\u002F","Gateway for AI model and MCP tool traffic, built on Lunar.dev technology. It limits which tools each agent can call. Its enterprise version adds an approval step for new MCP servers and logs each call with the user or agent behind it.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":146,"product_name":147,"url":148,"description":149},"prisma-airs","Prisma AIRS","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fai-security\u002Fprisma-airs","Security for AI applications, models and agents, including runtime protection against prompt injection.",[151],{"slug":152,"name":21,"logo_path":153,"roles":154},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[155],"reported_by",{"slug":157,"title":158,"body":159,"framework_refs":160,"framework_notes":167},"ai-powered-cicd-tools-expose-secrets-through-prompt-injection","AI-Powered CI\u002FCD Tools Expose Secrets Through Prompt Injection","A prompt injection vulnerability in Anthropic's Claude Code GitHub Action allowed attackers to manipulate AI agents into reading sensitive environment variables and exposing CI\u002FCD secrets like API keys. The vulnerability exploited the AI tool's file reading capabilities to access \u002Fproc\u002Fself\u002Fenviron, demonstrating how AI agents can be tricked into performing unintended actions when processing untrusted input. This incident highlights the critical need to secure AI-powered development tools and treat them as potential attack vectors in the software supply chain. Organizations using AI agents in CI\u002FCD pipelines must implement strict access controls and input validation to prevent similar exposures.",[161,162,163,164,165,166],"CIS Control 2","CIS Control 16","NIST SP 800-218","NIST AC-3","OWASP SCVS-1","SLSA Level 2",{}]