# claude-code-github-action-prompt-injection-credential-theft-microsoft: Claude Code GitHub Action: Prompt-Injection Credential Theft (Microsoft Disclosure)

> Claude Code GitHub Action: Prompt-Injection Credential Theft (Microsoft Disclosure) is a high-severity prompt injection issue in Claude Code GitHub Action, a CI integration. Affected: <2.1.128. Fixed in 2.1.128.

- **Canonical URL:** https://catalog.anomity.ai/vuln/claude-code-github-action-prompt-injection-credential-theft-microsoft
- **Aliases:** ti-034
- **Severity:** high
- **Attack type:** Prompt injection, Credential theft
- **Component:** Claude Code GitHub Action (CI integration)
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-06-06
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/claude-code-github-action-prompt-injection-credential-theft-microsoft

## Summary

Microsoft Security disclosed a now-patched flaw in Anthropic's Claude Code GitHub Action: attackers hide prompt-injection instructions in GitHub issues, pull requests, or comments to manipulate the agent into reading files that hold CI/CD secrets (API keys, cloud credentials) and exfiltrating them. Reported via HackerOne on 2026-04-29 and patched in Claude Code 2.1.128 on 2026-05-05; publicly detailed 2026-06-06.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| <2.1.128 | 2.1.128 |

## Am I affected by this vulnerability?

You are affected if you run Claude Code GitHub Action <2.1.128. Versions 2.1.128 and later include the fix.

## How do I fix it?

Upgrade Claude Code to 2.1.128 or later. Treat all untrusted GitHub content (issues, PRs, comments) as hostile input; scope CI/CD secrets to least privilege and keep them out of agent-readable files. Review GitHub Action run logs for anomalous file access since late April.

## References

- article: https://tech.yahoo.com/ai/claude/articles/claude-code-vulnerability-could-let-180856806.html

## Related vulnerabilities

- [beyondtrust-a-hidden-comment-on-a-github-issue-hijacked-the-copilot](https://catalog.anomity.ai/vuln/beyondtrust-a-hidden-comment-on-a-github-issue-hijacked-the-copilot) — high
- [ghostaction-returns-a-security-audit-yml-workflow-pushed-from](https://catalog.anomity.ai/vuln/ghostaction-returns-a-security-audit-yml-workflow-pushed-from) — high
- [manus-one-email-with-a-jsfuck-payload-or-one-shared-project-instruction](https://catalog.anomity.ai/vuln/manus-one-email-with-a-jsfuck-payload-or-one-shared-project-instruction) — high
- [ghostjacking-a-firewall-block-log-is-an-injection-channel-because-the](https://catalog.anomity.ai/vuln/ghostjacking-a-firewall-block-log-is-an-injection-channel-because-the) — high
- [trapdoor-cross-ecosystem-supply-chain-attack-poisons-ai-assistant](https://catalog.anomity.ai/vuln/trapdoor-cross-ecosystem-supply-chain-attack-poisons-ai-assistant) — critical
- [forever-security-an-agents-md-planted-in-downloads-got-codex-to](https://catalog.anomity.ai/vuln/forever-security-an-agents-md-planted-in-downloads-got-codex-to) — high

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=claude-code-github-action-prompt-injection-credential-theft-microsoft