AI-powered coding tools are rapidly changing how developers build and ship software. But as these tools enter everyday development pipelines, they are also opening new doors for attackers. <\/p>\n
A recently uncovered vulnerability in a widely used AI coding assistant shows just how far that risk can go.<\/a><\/p>\n Researchers found that GitHub Actions workflows powered by AI can be manipulated through simple text inputs, such as issue comments or pull request descriptions. <\/p>\n Since these inputs are read and acted on by an AI agent, a carefully crafted message can quietly redirect the agent to do things it was never supposed to do.<\/a><\/p>\n Microsoft Threat Intelligence identified the issue in Anthropic\u2019s Claude Code GitHub Action, noting that the AI agent could be tricked into reading sensitive environment files inside the CI\/CD runner. The finding was shared by Microsoft in a\u00a0report<\/a>\u00a0shared with Cyber Security News (CSN).<\/a><\/p>\n At the heart of the problem is a gap in how the tool handles file access versus command execution<\/a>. While the Bash tool ran inside a secure sandbox that stripped environment variables, the Read tool did not follow the same rules. <\/p>\n That inconsistency gave attackers a direct path to credentials that were never meant to leave the system. <\/a>The consequences could be serious for any team relying on automated AI workflows in their development pipeline. <\/p>\n A leaked API key could let an attacker impersonate the workflow, consume resources, or gain deeper access into connected systems. The issue was responsibly disclosed to Anthropic, which released a fix in Claude Code version 2.1.128 on May 5, 2026.<\/a><\/p>\n The vulnerability worked through what researchers call prompt injection. An attacker would place a hidden instruction inside a GitHub issue or pull request, written in a way that looks harmless to a human reviewer but is treated as a command by the AI model reading the raw text.<\/a><\/p>\n In tests conducted by Microsoft\u2019s team, a malicious prompt instructed the agent to perform a \u201ccompliance review.\u201d The phrasing was deliberate. <\/p>\n It avoided triggering Claude\u2019s built-in safety filters, which block obvious requests to print API keys. By disguising the request and telling the model to trim the first seven characters of the result, the attacker bypassed both the AI\u2019s refusal layer and GitHub\u2019s Secret Scanner.<\/a><\/p>\n The Read tool, once manipulated, accessed\u00a0 From there, the attacker could reconstruct the full key and exfiltrate it through channels the workflow allowed<\/a>, including web requests, issue comments, or action logs.<\/a><\/p>\n Microsoft noted the attack chain maps to several MITRE ATLAS techniques, including LLM Prompt Injection, AI Agent Tool Invocation, LLM Jailbreak, and AI Agent Tool Credential Harvesting<\/a>. The full exploit required no special access, just the ability to open an issue or submit a pull request.<\/a><\/p>\n Microsoft\u2019s team laid out practical steps for defenders. The most important principle they introduced is the \u201cAgents Rule of Two.\u201d <\/p>\n An AI workflow should never combine all three of the following at the same time: processing untrusted input, accessing sensitive secrets, and taking external actions or modifying state.<\/a><\/p>\n Teams should apply strict least-privilege controls to every token and API key wired into a workflow. Each key should be scoped to only what that specific workflow needs, and usage should be monitored at the provider level for unusual activity. <\/p>\n Alerts tied to new IP addresses or unexpected endpoint calls can give defenders early warning.<\/a><\/p>\n On the prompt level, Microsoft recommends hardening the system prompt<\/a> so the agent clearly understands what counts as data versus what counts as an instruction. <\/p>\n A well-written system prompt should name the surfaces the agent reads, such as issue bodies or pull request diffs, and make clear that all of that content is untrusted. <\/p>\n Pinning the agent to a single, defined task reduces the chances it gets steered off course by a cleverly worded payload.<\/p>\n Follow us on\u00a0Google News<\/a>,\u00a0LinkedIn<\/a>,\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates<\/strong>,\u00a0Set CSN as a Preferred Source in<\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong> Google<\/a><\/strong><\/strong>.<\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/p>\n The post Microsoft Warns Claude Code GitHub Action Could Leak CI\/CD Workflow Secrets<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\nMicrosoft Warns Claude Code GitHub Action Could Leak<\/strong><\/h2>\n
![\"Attack](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiWpwTNNfIpp445wXWMy9Drmxt0XB1bC1L6B6gk9CvNAkQ9_HL6b-Eg0AOiudjZErXCg4_MDKp-KWS644HITFFJPL6XfxB-8RE_jkCwa2ObkF_ar1a6dYP31gd9lOpKyXtIeiB7IPBv7gdQCP8KnSAJo4gM8shLyfni2-reMieQqtLJCs4gs2DBCXgoWOU\/s16000\/Attack%2520flow%2520%28Source%2520-%2520Microsoft%29.webp?ssl=1\")
\/proc\/self\/environ<\/code>\u00a0directly inside the runner\u2019s process memory. This returned the unscrubbed\u00a0ANTHROPIC_API_KEY<\/code>\u00a0along with other credentials present in the environment. <\/p>\nHardening AI-Powered CI\/CD Workflows<\/strong><\/h2>\n