Claude Code Action bug leaks API keys via prompt injection

The blog post discusses security vulnerabilities in Anthropic's Claude Code GitHub Action, primarily related to how AI agents interact with CI/CD workflows. It highlights that unsecured processing of GitHub content can lead to exposure of sensitive information, such as API keys. The issue stems from the Read tool’s lack of sufficient sandboxing compared to other tools like Bash, allowing unauthorized access to environment variables.

Following this discovery, Anthropic implemented mitigations in Claude Code version 2.1.128 to prevent access to sensitive proc files. The research shows that prompt injection attempts in public repositories can exploit these vulnerabilities. The post outlines a detailed attack vector, emphasizing the need for strict controls and guidelines to avoid misuse of AI in CI/CD processes, and suggests defensive strategies, such as enforcing separation of capabilities to safeguard against attacks.