Claude Code GitHub Action Flaw Let One Malicious Issue Hijack Repositories
Summary
A security flaw in Anthropic's Claude Code GitHub Action allowed attackers to hijack repositories by opening a single malicious GitHub issue that exploited a broken permission check and indirect prompt injection (tricking an AI by hiding instructions in its input). The vulnerability let attackers steal credentials needed to gain write access to code and workflows, potentially poisoning the Claude Code Action itself for downstream projects that use it.
Solution / Mitigation
Update to claude-code-action v1.0.94 or later. Then audit any workflow that lets users without write access or bots trigger Claude: if it takes untrusted input, limit secrets to only the Anthropic API key and GITHUB_TOKEN, and remove tools and permissions that could be used for stealing data.
Classification
Affected Vendors
Related Issues
Original source: https://thehackernews.com/2026/06/claude-code-github-action-flaw-let-one.html
First tracked: June 4, 2026 at 02:00 PM
Classified by LLM (prompt v3) · confidence: 95%