Claude Code Vulnerability Could Let Attackers Steal Credentials From GitHub, Says Microsoft

Microsoft researchers revealed a now-patched vulnerability in Anthropic’s Claude Code GitHub Action that allowed attackers to expose credentials stored in software development pipelines by manipulating the AI ​​agent via malicious GitHub content.

In one blog post On Friday, Microsoft warned that AI coding agents running within CI/CD workflows could create new security risks because those environments often have access to API keys, cloud credentials and other sensitive information.

“We initiated this investigation after observing rapid injection attempts into public repositories using AI-enabled GitHub workflows from multiple vendors, causing attacker-controlled issues or problems [pull requests]content is processed by the AI ​​agent and may affect the use of the tool,” Microsoft wrote.

On GitHub, developers can propose changes to a code repository with a pull request and have those changes reviewed before they are approved and merged.

The report comes at a time when rapid injection attacks have emerged as one of the biggest security threats facing AI agents. In a prompt injection attack, an attacker hides instructions in content such as emails, documents, websites, or code comments, causing an AI system to follow those instructions instead of the user’s.

Launched in October, Claude Code is Anthropic’s AI coding agent for software development tasks. The tool came under scrutiny in March after Anthropic accidentally leaked more than 500,000 lines of its source code, exposing details of its internal architecture and prompting widespread analysis by researchers and developers.

According to Microsoft, attackers could use quick injection attacks hidden in GitHub issues, pull requests, or comments to manipulate Claude Code to access files containing sensitive credentials.

To test the vulnerability, Microsoft created a GitHub workflow and disguised malicious instructions behind content hosted on a domain it controlled, allowing the researchers to bypass Claude’s security features. The quick injection attack prompted Claude to read sensitive credentials and modify them to bypass both Claude’s security and GitHub’s secret scanning tools. Microsoft said an attacker can then reconstruct the credentials and exfiltrate them via issue notes, workflow logs, web requests or shell commands.

“To bypass Sonnet’s denial safety mechanisms, we concealed the grenade payload behind a response from our controlled domain,” the company said. “We also enabled the workflow to be triggered by users without ‘write’ permissions to ensure that Anthropic’s environment variable scrub restrictions were active during our testing.”

Anthropic patched the flaw on May 5 with Claude Code version 2.1.128 after Microsoft disclosed the vulnerability via HackerOne on April 29.

Despite multiple layers of built-in security controls, Microsoft discovered that a determined attacker could potentially manipulate an AI agent into revealing sensitive information.

“We are entering an era where natural language is executable code, and untrusted input such as GitHub issues should be treated as adversarial by default,” the report said. “A single, carefully crafted comment combined with a misunderstood trust boundary is all it takes to walk away with production credentials.”