Cases › security breach › LR-2026-0578
Claude Code GitHub Action prompt-injection flaw could expose GitHub credentials
Preliminary Why: 1 report: Decrypt · subject to change · 1 independent report
Status: fix reported
No source states: loss or records, could do, deployer.
Anthropic's Claude Code GitHub Action, an AI coding agent that reviews GitHub issues and pull requests, was found by Microsoft researchers to be open to prompt injection. Malicious instructions hidden in GitHub content could make the agent read sensitive credentials and alter them to evade safeguards and secret scanning, after which an attacker could reconstruct and exfiltrate them. Microsoft tested the attack in a workflow it created and disclosed the issue through HackerOne on April 29. Anthropic patched the flaw on May 5 with Claude Code version 2.1.128. Microsoft's blog post warned that AI coding agents in CI/CD workflows may create new security risks.
What happened
What was done
“Anthropic patched the flaw on May 5 with Claude Code version 2.1.128”
Vulnerability scanning of AI components
Same developer, same risk, after the fix: LR-2026-0086 · LR-2026-0089
Risks
Primary50 incidents
Rising: 6 vs 2.8 a week
Read from the sources; not yet reviewed by a person.
Controls
Infrastructure / targetNot effective (bypassed) Secrets scanning
Control failure chain
L1 · ModelAnthropicModel provider
No source mentions a control at this layer.
Model version not linked to a model card.
L2 · HarnessClaude Code GitHub ActionAgent framework vendor
No source mentions a control at this layer.
Other controls for this risk at this layer, not mentioned in the sources: Outside content treated as data, not instructions, Prompt-injection detection, Confirmation after untrusted input, Validation of tool inputs and outputs, Tool allow-list.
L3 · ApplicationDeployer not namedDeployer
No source mentions a control at this layer.
Other controls for this risk at this layer, not mentioned in the sources: Human approval for high-impact actions, Least-privilege access for the agent, Segmentation of agent components, Alerts on unusual tool use.
L4 · Infrastructure / targetOrganisation hit
EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target
Controls for this risk: result in this incident
| Control | Part of the system | Result |
|---|---|---|
| Tool allow-list | L2 Harness | Not stated in sources |
| Confirmation after untrusted input | L2 Harness | Not stated in sources |
| Outside content treated as data, not instructions | L2 Harness | Not stated in sources |
| Prompt-injection detection | L2 Harness | Not stated in sources |
| Validation of tool inputs and outputs | L2 Harness | Not stated in sources |
| Least-privilege access for the agent | L3 Application | Not stated in sources |
| Human approval for high-impact actions | L3 Application | Not stated in sources |
| Segmentation of agent components | L3 Application | Not stated in sources |
| Alerts on unusual tool use | L3 Application | Not stated in sources |
| Secrets scanning | L4 Infrastructure / target | Not effective (bypassed) |
Similar incidents
Evidence
- Cause hostile input carried instructions
- What set it off hidden instructions in its input
- What was done Anthropic patched the flaw on May 5 with Claude Code version 2.1.128
No source states: when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, what was done.
Show the full account: 2 items from the primary sources
What happened, in order
- April 29 Microsoft disclosed the vulnerability to Anthropic through HackerOne.
- May 5 Anthropic patched the flaw with Claude Code version 2.1.128.
Show every field, with its source and grade
The AI system
What happened
Impact
Context
Notes on gaps
Year 2026 for dates taken from the source publication date header. The environment-variable scrubbing mitigation was reported active during tests but the source does not say whether it held, so it is not listed. The advice remediation is Microsoft's statement, not an action taken by a party.
LR-2026-0578 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON