A flaw in Anthropic’s Claude Code GitHub Action allowed an attacker to hijack public repositories simply by opening a malicious GitHub issue, requiring no authentication or special access. Because Anthropic’s own repository used the same vulnerable workflow, a successful attack could have injected malicious code into the action itself, poisoning every downstream project that consumes it. Researcher RyotaK of GMO discovered and reported the issue.

Architect’s Take: Audit any GitHub Actions workflows that trigger on untrusted events such as ‘issues’ or ‘pull_request_target’ and ensure they do not have write permissions or access to secrets without explicit trust gates. If you use Claude Code GitHub Action, verify you are pinned to a patched version and review your workflow permissions using the principle of least privilege.

Original advisory: Claude Code GitHub Action Flaw Let One Malicious Issue Hijack Repositories