Anthropic’s Claude Code GitHub Action could unintentionally expose CI/CD workflow secrets when AI agents process untrusted GitHub content.
The risk arises because certain tools the agent uses to read files were not sandboxed like subprocess execution paths such as Bash. In particular, the Read tool was able to access /proc/self/environ and returned environment variables, including ANTHROPIC_API_KEY and potentially other credentials available to the runner.
Researchers began this work after noticing prompt injection attempts in public repositories where AI-assisted workflows from several vendors processed attacker-controlled issue bodies, pull request descriptions, or comments.
Attackers hid malicious instructions in places that are invisible to standard browsing HTML comments inside issues, for example but still visible to models that read raw markdown.
In one observed campaign, a fork of a popular documentation project used a permissive workflow that gave an AI bot broad tools: searching the repository, reading files, creating commits, and opening pull requests.
An attacker could craft a seemingly normal feature request that instead contained a precise sequence of commands. The AI followed those steps, locating the target file, appending an invisible XSS payload, and opening a pull request that, if merged, would silently exfiltrate visitor session tokens when the site rendered the poisoned page.
The same attack logic makes the Read tool vulnerability dangerous. If an attacker can influence the agent’s behavior through injected prompts, they can steer the agent to sensitive files accessible in the CI runner.
GitHub Actions runners can contain repository contents, event metadata, the GITHUB_TOKEN, cloud credentials, and third-party API keys. When these values are available to an AI agent that reads untrusted content, the trust boundary collapses.
Tool permissions, model selection, and most other runtime behavior are SDK options that the action is responsible for setting.
Researchers in Microsoft began this work after noticing prompt injection attempts in public repositories where AI-assisted workflows from several vendors processed attacker-controlled issue bodies, pull request descriptions, or comments.
Anthropic had implemented environment scrubbing and Bubblewrap sandboxing for subprocesses such as Bash, which helps prevent environment variables leaking when those tools run.
However, the Read tool performed in-process file reads and bypassed the sandbox. Microsoft’s team constructed a prompt injection that first had the model read /proc/self/environ, then launder the found key before output so safety filters and GitHub’s secret scanner would not detect it.
Microsoft Warns Claude Code GitHub
The Read tool returned the unscrubbed environment, exposing ANTHROPIC_API_KEY. From there, an attacker could exfiltrate credentials through a web fetch, a GitHub comment, or by writing to logs.
Microsoft disclosed the issue to Anthropic via HackerOne. Anthropic released Claude Code version 2.1.128 on May 5, 2026, which blocks access to sensitive /proc files and prevents this particular exfiltration path.
This mitigation reduces the immediate risk, but defenders should still treat AI workflows that process untrusted GitHub content as high-risk when they also have access to secrets, file-read tools, or external communication channels.
Practical hardening steps include applying the “Agents Rule of Two”: ensure no AI workflow simultaneously processes untrusted input, holds secrets or sensitive access, and can change state or communicate externally.
Enforce least privilege for every token, scope API keys narrowly, and monitor usage for anomalies. Strengthen the system prompt and explicitly declare trust boundaries in the workflow so the agent treats issue bodies, PRs, and file contents as untrusted data, not instructions.
Finally, pin the workflow to a single clear task and have it refuse anything outside that scope.
As AI agents become more common in CI/CD, these patterns sandboxing, strict token scoping, explicit trust models, and minimal privileges are essential to prevent prompt injection and secret exfiltration in automated development pipelines.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
