Executive Summary
RyotaK found a Claude Code GitHub Action flaw letting a single malicious issue take over public repos running it, including Anthropic's own action repo.
What Happened
A security researcher found a flaw in Anthropic's Claude Code GitHub Action that let an attacker take over vulnerable public repositories running it, with nothing more than a single opened GitHub issue. Because Anthropic's own action repo used the same workflow, a working attack could have pushed malicious code into the action itself and onto the projects downstream that pull it. RyotaK of GMO
Affected Products
- Claude Code GitHub Action
Vulnerability / Attack Technique
Prompt injection via GitHub issues
Technical Mechanism
As reported, issue content reached the agent with repository write access.
AI Security Category
LLM01:2025 Prompt Injection
Part of the Prompt Injection topic.
Relevant Frameworks
RealGround Analysis
CI agents that read untrusted issues need minimal permissions.
Recommended Controls
- Update the Claude Code Action
- Limit workflow permissions
Related RealGround Service
AI Agent SBOM and LLM Mapping · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/06/claude-code-github-action-flaw-let-one.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.