Anthropic Claude Code GitHub Action Flaw Enables Repo Hijacking

The discovery of a significant vulnerability in Anthropic’s Claude Code GitHub Action by security researcher RyotaK of GMO Cybersecurity highlights the risks inherent in integrating autonomous agents into CI/CD pipelines. According to The Hacker News, the flaw permitted an attacker to take over public repositories by doing nothing more than opening a single GitHub issue containing a malicious payload.

Vulnerability Overview and Attack Mechanics

The vulnerability exists in the way the Claude Code GitHub Action interacts with repository content to provide automated maintenance and code suggestions. When the action is triggered by an event—such as a new issue being opened—it reads the input to generate context for its underlying large language model (LLM). However, because the LLM interprets the instructions within that issue as valid directives, an attacker could craft a prompt injection to force the action to execute unauthorized commands.

In a typical scenario, the Claude Code GitHub Action vulnerability allows an attacker to bypass standard security boundaries. By embedding specific instructions in a GitHub issue, a malicious actor can influence the agent to modify the repository’s source code, exfiltrate environment variables, or perform Privilege Escalation within the runner environment. Since these actions are performed using the repository’s own GITHUB_TOKEN, they often appear as legitimate automated maintenance, complicating detection for the SOC.

Supply Chain Attack Potential

Perhaps the most concerning aspect of RyotaK’s research was the discovery that Anthropic’s own repository for the Claude Code action was susceptible to the same flaw. This configuration created a path for a major Supply Chain Attack. If an attacker had successfully exploited the flaw against the official Anthropic repository, they could have pushed malicious code directly into the action itself.

Because thousands of projects integrate this action into their own build processes, a compromised version of the action would have propagated the malicious code downstream to every project utilizing it. This illustrates how a single CVE in a widely used CI/CD component—even if it is a logical flaw rather than a memory corruption issue—can have catastrophic effects across the ecosystem. This TTP demonstrates the growing trend of targeting automation to gain wide-scale access.

Detection and Remediation

Detecting this type of exploit requires a focus on workflow logs and unexpected repository modifications. Traditional EDR solutions often lack visibility into the hosted runner environments provided by GitHub, making it essential for defenders to ingest and analyze GitHub Audit Logs within their SIEM.

How to Mitigate Claude Code Exploit

To address this specific threat, organizations must adopt several defensive layers. First and foremost, updating to the latest version of the Claude Code GitHub Action is required, as Anthropic has implemented improved isolation and input sanitization. Beyond patching, defenders should implement the following security measures:

• Restrict Token Permissions: Configure the GITHUB_TOKEN with the minimum necessary permissions. Avoid granting contents: write permissions to workflows triggered by external, untrusted events like issues or issue_comment unless strictly necessary.
• Manual Approval Workflows: For public repositories, require manual approval for all workflow runs triggered by first-time contributors. This prevents an automated RCE or hijack attempt from succeeding without human oversight.
• Pin Actions to SHAs: Instead of using mutable tags (e.g., @v1), pin GitHub Actions to a specific commit SHA to prevent the automatic ingestion of potentially compromised updates.

By focusing on protecting GitHub Actions from malicious issues, security teams can neutralize the prompt injection vector that made this exploit possible. Organizations researching how to detect Claude Code exploit attempts should look for unusual git operations or network requests originating from the GitHub Actions runner that do not align with established baseline behavior.