𝗖𝗹𝗮𝘂𝗱𝗲 𝗖𝗼𝗱𝗲 𝗟𝗲𝗮𝗸𝗲𝗱 𝗖𝗜/𝗖𝗗 𝗦𝗲𝗰𝗿𝗲𝘁𝘀

𝗖𝗹𝗮𝘂𝗱𝗲 𝗖𝗼𝗱𝗲 𝗟𝗲𝗮𝗸𝗲𝗱 𝗖𝗜/𝗖𝗗 𝗦𝗲𝗰𝗿𝗲𝘁𝘀

Microsoft found a flaw in Anthropic's Claude Code GitHub Action.

Attackers used prompt injection to steal secrets. They put malicious text in issue bodies or PR descriptions. The AI read environment variables from the system. This leaked the API key.

The bug happened because of bad sandboxing. The Read tool lacked restrictions.

Anthropic fixed this in version 2.1.128. The update blocks access to sensitive system paths.

Update your version now to stay safe.

Source: https://gridthegrey.com/posts/claude-code-github-action-leaked-ci-cd-secrets-via-prompt-injection/ Source: https://dev.to/bansac1981/claude-code-github-action-leaked-cicd-secrets-via-prompt-injection-163o Optional learning community: https://t.me/GyaanSetuAi