Poisoning Claude Code: One GitHub Issue to Break the Supply Chain Posted on June 1, 2026 • 16 minutes • 3372 words Table of contents Introduction TL;DR Claude Code GitHub Actions Overview Permission Model of Claude Code GitHub Actions GitHub Apps and Public Repositories Exfiltration and Repository Compromise Common Misconfiguration of Claude Code GitHub Actions Chaining Workflows for Full Compromise Conclusion Timeline Shameless Plug Introduction Hello, I’m RyotaK ( @ryotkak ), a security researcher at GMO Flatt Security Inc. After publishing my previous article ( Pwning Claude Code in 8 Different Ways ), I continued investigating Claude-related products and found several more vulnerabilities. In this article, I will explain a vulnerability in Claude Code’s GitHub Actions that could allow an attacker to compromise any repository that uses the Claude Code workflow, including Anthropic’s own repositories. 1 Note: Variants of the misconfiguration issues described in this article were actively exploited in the wild before this article was published. While the issues are now mitigated, if you are using Claude Code GitHub Actions, I strongly recommend that you: Audit your configuration to check whether you have any of the vulnerable patterns described in this article. When using allowed_non_write_users , do not expose secrets other than the Anthropic API key and secrets.GITHUB_TOKEN , and do not grant any additional permissions that could enable data exfiltration (even gh issue view can be abused for exfiltration). Review your workflow run logs for any signs of compromise. TL;DR Anthropic provides a GitHub Actions workflow that integrates Claude Code into CI/CD pipelines. I found a vulnerability that let an attacker bypass its permission controls and feed untrusted input into a workflow designed to process only trusted input. By default, the workflow has read and write access to code, issues, pull requests, discussions, and workflow files, so this bypass could be used to inject malicious code or steal sensitive information from the repository. Since the Claude Code GitHub Actions repository itself uses this workflow, an attacker could even compromise the action’s source code, which would then propagate to every downstream repository, including Anthropic’s own. Separately, I also found a misconfiguration in the example workflow provided by Anthropic that allowed any external contributor to exfiltrate the GitHub token and compromise the repository. Anthropic has acknowledged these vulnerabilities and fixed them as of Claude Code GitHub Actions v1.0.94. Claude Code GitHub Actions Overview Claude Code GitHub Actions is a workflow provided by Anthropic that integrates Claude Code into CI/CD pipelines. It can be used to automate code reviews, triage and label issues, and generate code based on comments. The workflow has two modes: tag mode : triggered when a user mentions a specific keyword ( @claude by default) in an issue or pull request comment. agent mode : triggered when the workflow is configured with a prompt input. This mode is typically used to run slash commands or predefined tasks. For example, the following configuration runs the /dedupe slash command in agent mode: .github/workflows/claude-dedupe-issues.yml lines 26-33 - name : Run Claude Code slash command uses : anthropics/claude-code-action@v1 [...] with : [...] prompt : "/dedupe ${{ github.repository }}/issues/${{ github.event.issue.number || inputs.issue_number }}" To perform GitHub-specific operations, the workflow requires the Claude GitHub App to be installed on your repository. The app has the following permissions: Read and write access to repository contents (Code) Read and write access to issues and pull requests Read and write access to discussions Read and write access to workflows (Actions) If no other token is specified, the token tied to this GitHub App is used by default, which simplifies setup for developers. Permission Model of Claude Code GitHub Actions These default permissions are powerful, but they also pose a security risk. If the workflow processes untrusted input, an attacker could manipulate Claude Code through indirect prompt injection and abuse those permissions. To mitigate this, Claude Code GitHub Actions disallows users without write access from triggering the workflow by default. docs/security.md Repository Access: The action can only be triggered by users with write access to the repository This permission control is implemented in the checkWritePermissions function: src/github/validation/permissions.ts lines 13-68 export async function checkWritePermissions( [...] ) : Promise< boolean > { [...] core.info( `Checking permissions for actor: ${ actor } ` ); [...] // Check if the actor is a GitHub App (bot user) if (actor.endsWith( "[bot]" )) { core.info( `Actor is a GitHub App: ${ actor } ` ); return true ; } [...] if (permissionLevel === "admin" || permissionLevel === "write" ) { core.info( `Actor has write access: ${ permi...