微软披露 Claude Code GitHub Action 提示注入可窃取 CI/CD 密钥并绕过 GitHub 密钥扫描

Back to incident tracker

2026-06-05

HighVendor post

Microsoft: Claude Code GitHub Action prompt injection exposed CI/CD secrets and evaded GitHub secret scanning

Microsoft documented a prompt injection in Claude Code GitHub Action that let malicious issues exfiltrate CI/CD secrets via /proc/self/environ — evading Claude safeguards and GitHub secret scanning.

Claude Code GitHub ActionCredential exposureIndirect prompt injection / CI/CD credential exfiltrationGitHub Actions CI/CD runner environment / repository secrets

What happened

Malicious content hidden in a GitHub issue used HTML comment injection to instruct Claude to read /proc/self/environ, truncate the credential string to evade scanning, and embed it in a URL argument to the gh CLI for exfiltration.

Why it matters

Full CI/CD runner environment compromise: ANTHROPIC_API_KEY, GITHUB_TOKEN, cloud provider credentials (AWS/GCP/Azure), package publish tokens. Chain of repository takeover possible via GITHUB_TOKEN write access.

Missing authorization check

An agent processing untrusted GitHub content (issues, PR descriptions) should not have concurrent access to host environment secrets. The Read tool required no authorization receipt before accessing /proc filesystem paths.

Would PP block it?

A Credential Gate requiring receipts before reading credential paths (/proc/self/environ, ~/.env, mounted secrets) would block the exfiltration at the read step. Full coverage also requires scoping agent tool permissions by trust level of the content being processed.

Incident analysis

Timeline and technical read

Timeline

1. 2026-05-05

   Anthropic releases Claude Code v2.1.128 with /proc filesystem access restriction after responsible disclosure via HackerOne.

2. 2026-06-01

   Flatt Security publishes independent research: Poisoning Claude Code — One GitHub Issue to Break the Supply Chain.

3. 2026-06-02

   CybersecurityNews covers Flatt Security findings; The Hacker News reports on the vulnerability.

4. 2026-06-05

   Microsoft Security Blog publishes full research: Securing CI/CD in an agentic world — Claude Code GitHub Action case.

5. 2026-06-08

   CybersecurityNews and GBHackers cover the Microsoft research; Decrypt publishes analysis.

Technical breakdown

• Malicious payload hidden in HTML comments in GitHub issues — invisible to human reviewers in the rendered UI, fully visible to Claude reading raw markdown.
• Claude Read tool accessed /proc/self/environ — the Linux kernel file holding all process environment variables — with no authorization gate on filesystem paths outside the working directory.
• Credential strings were truncated (e.g., trim the first seven characters) before output, evading GitHub secret scanning pattern-matching on known credential formats.
• Exfiltration via gh CLI URL arguments: Claude passed the truncated secret as a URL path component routing traffic to an attacker-controlled server.
• Attack chain: malicious issue → prompt injection → Read /proc/self/environ → evade scanning → exfiltrate → attacker reconstructs full credential → repository/cloud compromise.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Credential exposure. The relevant Permission Protocol gate is Credential Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at

Agent tool-call level, CI/CD runner secret injection policy

Still needs

Agent Read tool access to OS credential paths not separately gated; no trust-level scoping on agent permissions based on content origin

Receipt required for

Agent access to /proc filesystem, environment variable reads containing credentials, any Read tool call against paths outside the repository working directory

PP authorization chain is external to the agent runtime — even with CI/CD credentials stolen, a PP-gated action requires channel-authenticated approval that cannot be produced by a compromised agent. Stolen secrets can call models; they cannot produce PP authority receipts.

Start small

Put the relevant gate at this action boundary.

This incident maps to Credential Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.