2026-06-05 · 2026-Q2
Claude Code GitHub Action Prompt-Injection Secret Exfiltration
PrimaryL2InstructionSecondaryL1CredentialL8Output / Destination
- Fixable:
- Yes, vendor patch
- Vendor response:
- Patched
- In the wild:
- No
- Actor:
- Attacker
Target
Claude Code GitHub Action before 2.1.128
Impact
Prompt injection hidden in GitHub issues, pull requests, or comments could steer the agent into reading unsanitized environment data through `/proc/self/environ` and exfiltrating CI/CD secrets, API keys, and cloud credentials through issue comments, workflow logs, web requests, or shell commands
Root Cause
The agent processed untrusted GitHub content in the same runtime that held privileged secrets; disclosed by Microsoft researchers through HackerOne on April 29, 2026 and patched in 2.1.128 on May 5, 2026