2026-06-05 · 2026-Q2
Claude Code GitHub Action Prompt-Injection Secret Exfiltration
Who actually said "do this"?
- Fixable
- Vendor patch
- Vendor response
- Patched
- In the wild
- No
- Actor
- Attacker
Target
Claude Code GitHub Action before 2.1.128
Impact
Prompt injection hidden in GitHub issues, pull requests, or comments could steer the agent into reading unsanitized environment data through `/proc/self/environ` and exfiltrating CI/CD secrets, API keys, and cloud credentials through issue comments, workflow logs, web requests, or shell commands
Root cause
The agent processed untrusted GitHub content in the same runtime that held privileged secrets; disclosed by Microsoft researchers through HackerOne on April 29, 2026 and patched in 2.1.128 on May 5, 2026
Sources
Catalog
Cite this: AgentProv incident record: Claude Code GitHub Action Prompt-Injection Secret Exfiltration (2026-06-05). https://agentprov.com/incidents/2026-06-05-claude-code-github-action-prompt-injection-secret-exfiltration
Related
- Also L2 · 2026-10-15Datadog: Counterfeit Policy Text Collapses an Injection Classifier's Recall and Pushes a LangChain Risk Gate Under Its Block ThresholdL2Instruction
- Also L2 · 2026-10-08Cisco Talos: Four Malware Families Carry Instructions Aimed at the LLMs That Triage ThemL2Instruction
- Also L2 · 2026-10-07Barracuda: Phishing Emails Carry Hidden Prompt Injections for the Recipient's AI Inbox AssistantL2Instruction