Microsoft has disclosed a vulnerability in Anthropic's Claude Code GitHub Action that could allow attackers to access sensitive credentials.
Microsoft Reports Vulnerability in Claude Code GitHub Action
Microsoft has identified a significant vulnerability in Anthropic's Claude Code GitHub Action that could have been exploited to access sensitive credentials through prompt injection attacks. This flaw allowed attackers to manipulate the AI agent by embedding harmful instructions in GitHub issues, pull requests, or comments.
In a recent blog post, Microsoft highlighted the risks posed by AI coding agents in continuous integration and continuous delivery (CI/CD) environments, which often handle sensitive data such as API keys and cloud credentials. They noted that their investigation was initiated after observing prompt injection attempts across various public repositories using AI-assisted workflows.
The report emphasizes that prompt injection attacks represent a major security challenge for AI systems. These attacks involve concealing malicious instructions within various content types, tricking the AI into executing unintended commands instead of following the user's directives.
Claude Code, introduced in October, is Anthropic's AI tool for software development. It previously faced scrutiny earlier this year when over 500,000 lines of its source code were leaked, prompting further analysis by researchers.
Microsoft demonstrated the vulnerability by creating a GitHub workflow that concealed harmful instructions, successfully bypassing Claude's safety measures. This manipulation allowed the AI to read and modify sensitive credentials, which could then be extracted by attackers through various means, including issue comments and workflow logs.
Following Microsoft's report through HackerOne, Anthropic addressed the vulnerability on May 5 by releasing Claude Code version 2.1.128. Despite existing security measures, Microsoft warned that determined attackers could still exploit AI agents to reveal confidential information.
Microsoft concluded that as natural language processing increasingly resembles executable code, inputs from untrusted sources like GitHub need to be treated with caution. A carefully crafted comment could potentially lead to the exposure of production credentials.
