Executive Summary
CSA describes a critical permission bypass in Anthropic's Claude Code GitHub Action, where untrusted PR titles and issue bodies were treated as prompt content, risking repository compromise and API key theft.
What Happened
This CSA research note describes a critical permission-bypass issue in Anthropic’s Claude Code GitHub Action and explains how untrusted GitHub metadata such as PR titles and issue bodies can be treated as prompt content. The write-up connects prompt injection to repository compromise, live API key theft, and broader CI/CD supply chain risk.
Affected Products
- Claude Code GitHub Action
Vulnerability / Attack Technique
Prompt injection via repository metadata
Technical Mechanism
As reported, untrusted GitHub text reached the agent as instructions.
AI Security Category
LLM01:2025 Prompt Injection
Part of the Prompt Injection topic.
Relevant Frameworks
RealGround Analysis
Any user who can open an issue can address the agent. RealGround analysis: CI agents need least privilege and no secrets in reach.
Recommended Controls
- Update the Claude Code Action
- Do not trigger agents on untrusted contributors' events
- Limit secrets available to agent jobs
Related RealGround Service
Secure AI Agent Build · or start with the free AI Agent Security Scanner.
Sources
Cloud Security Alliance: https://labs.cloudsecurityalliance.org/research/csa-research-note-claude-code-github-action-prompt-injection/
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.