Claude Code GitHub Actions Flaw Could Have Let Attackers Hijack Repositories

A newly disclosed Claude Code GitHub Actions vulnerability could have allowed attackers to compromise public repositories that used vulnerable Anthropic workflows. The issue was serious because the attack could start from a malicious issue or pull request and end with access to repository write permissions.

Security researcher RyotaK of GMO Flatt Security detailed the flaw in a technical research report published on June 1, 2026. Anthropic addressed the issue as of Claude Code GitHub Actions v1.0.94, according to the researcher.

The vulnerability did not affect every GitHub repository. It affected repositories that used vulnerable Claude Code GitHub Actions configurations, especially workflows that processed untrusted issue or pull request content with broad permissions.

How the Claude Code GitHub Actions Vulnerability Worked

Claude Code GitHub Actions lets developers bring Claude into GitHub workflows for code review, issue triage, pull request handling, and automation. Anthropic’s Claude Code GitHub Actions documentation says the integration can respond to mentions in issues or pull requests and run Claude inside GitHub Actions workflows.

The problem centered on a permission check in the action. Claude Code GitHub Actions normally limits workflow execution to users with write access to the repository. However, the researcher found that the check trusted actors ending in “[bot]” without confirming whether the bot actually had the required repository permissions.

That created a bypass path. An attacker could create a GitHub App, install it on a repository they controlled, and then use the app’s token to open an issue or pull request on a target public repository. Because the actor looked like a GitHub App bot, the workflow could treat the attacker-controlled input as trusted.

Issue	Impact	Status
Bot actor permission bypass	Could let untrusted users trigger Claude workflows	Fixed as of v1.0.94
Prompt injection through issues	Could push Claude to run unintended commands	Mitigated with additional hardening
Workflow summary leakage	Could expose sensitive output in public workflow summaries	Summary disabled by default
Issue-editing attack chain	Could alter trusted issue content after a workflow trigger	Mitigated by ignoring post-trigger edits

Why GitHub App Permissions Made the Bug Dangerous

The attack became practical because GitHub Apps have specific permission behavior on public repositories. GitHub’s GitHub App permissions guide says apps do not receive permissions by default, but they can still have implicit access to public resources when acting on behalf of a user.

RyotaK showed that this assumption mattered in the Claude Code workflow. If a vulnerable workflow accepted any bot actor as trusted, a malicious GitHub App could reach the Claude action without having write access to the target repository.

After the workflow started, the attacker could use prompt injection. The malicious issue content could look like an error message or instruction that pushed Claude to read sensitive environment data from the GitHub Actions runner.

• The attacker creates a malicious GitHub App.
• The attacker installs it on a repository they control.
• The app opens an issue or pull request in the target public repository.
• The vulnerable permission check accepts the bot actor.
• Claude processes attacker-controlled content inside the workflow.
• Prompt injection attempts to expose environment variables or workflow tokens.

OIDC Tokens Raised the Supply Chain Risk

The most sensitive target in the workflow was GitHub Actions OIDC authentication data. GitHub explains in its OpenID Connect documentation that workflows can request short-lived tokens to prove the identity of a running job.

In this case, the researcher said the attacker could try to extract environment variables used to request an OIDC token. Claude Code GitHub Actions could then exchange that token through Anthropic’s backend for a Claude GitHub App installation token.

That installation token mattered because it could carry write access to repository contents, issues, pull requests, and workflows. If abused against Anthropic’s own Claude Code Action repository, the flaw could have become a supply chain compromise affecting downstream projects that depended on the action.

Anthropic Fixed the Vulnerability and Hardened the Workflow

Anthropic fixed the reported issues as of Claude Code GitHub Actions v1.0.94, according to the GMO Flatt Security research. The fixes went beyond the original bot actor bypass.

The company added stricter actor validation, disabled the workflow run summary by default, scrubbed environment variables from child processes, and added protections against exfiltration through command arguments. Anthropic also changed the workflow behavior so edited issues and comments after the workflow trigger would not get processed as trusted input.

RyotaK said Anthropic rated the vulnerabilities at 7.8 under CVSS v4.0 and awarded a $3,800 bounty plus a $1,000 bonus. The researcher also noted that related misconfiguration patterns had been exploited in the wild before the public write-up.

What Developers Should Check Now

Teams using Claude Code GitHub Actions should review their workflow files, especially if they allow non-write users to trigger automation. The Claude Code GitHub Actions documentation recommends limiting permissions and reviewing Claude’s suggestions before merging changes.

Developers should also check whether their workflows grant broad permissions such as contents write, pull requests write, issues write, or id-token write. These permissions may be legitimate, but they increase the impact of prompt injection when untrusted content reaches an AI agent.

GitHub’s app permissions guidance recommends selecting the minimum permissions required. That principle becomes more important when an AI tool can read issue text, run commands, call APIs, or write back to a repository.

1. Update Claude Code GitHub Actions to v1.0.94 or later.
2. Audit workflows using allowed_non_write_users.
3. Remove unnecessary write permissions from GitHub Actions jobs.
4. Limit access to secrets in AI-driven workflows.
5. Review workflow run logs for suspicious output or unexpected issue edits.
6. Do not let untrusted issue text control tools that can write to the repository.

Why This Matters for AI Coding Agents

The Claude Code GitHub Actions flaw shows how AI coding agents can turn ordinary collaboration features into a security boundary problem. Issue bodies, pull request comments, labels, and workflow summaries can become part of the agent’s input.

When that agent also has access to command execution, tokens, repository write permissions, or API tools, prompt injection can become more than a chat safety issue. It can become a software supply chain risk.

GitHub’s OpenID Connect model helps reduce reliance on long-lived secrets, but it still requires careful workflow scoping. A short-lived token can still cause damage if an attacker can force a workflow to request and misuse it.

FAQ