X-twitter Facebook-f Pinterest-p
X-twitter Facebook-f Pinterest-p

Claude Code GitHub Action flaw enabled repository hijacking


TL;DR

A flaw in Anthropic’s Claude Code GitHub Action let attackers bypass permission checks via a fake bot account and use prompt injection to steal OIDC tokens, gaining write access to any vulnerable repository. Anthropic patched the vulnerability within four days of disclosure.

The attack starts with a GitHub issue. Not a sophisticated one. Just an issue opened by a bot account with a carefully worded body that looks like an error message. When Claude Code’s GitHub Action picks it up for triage, it follows the instructions hidden inside, reads the process’s environment variables, and writes them back into the issue for the attacker to collect.

Those variables contain the credentials needed to request an OIDC token, which can be exchanged for a Claude GitHub App installation token with full write access to the repository’s code, issues, and workflows. Aim the attack at Anthropic’s own claude-code-action repository, which ran the same vulnerable workflow, and you could poison the action that thousands of downstream projects pull.

Security researcher RyotaK of GMO Flatt Security reported the vulnerability to Anthropic in January. The company fixed the core bypass within four days, with additional hardening through the spring. The patches are in claude-code-action v1.0.94. Anthropic rated the issues 7.8 under CVSS v4.0 and paid a bounty of $4,800.

How the bypass worked

The 💜 of EU tech

The latest rumblings from the EU tech scene, a story from our wise ol’ founder Boris, and some questionable AI art. It’s free, every week, in your inbox. Sign up now!

Claude Code GitHub Actions gives Claude read and write access to a repository’s code, issues, pull requests, discussions, and workflow files by default. To limit who can trigger those capabilities, the action checks whether the actor has write access to the repository.

The check had a hole. It automatically trusted any actor whose name ended in [bot], on the assumption that GitHub Apps are trusted tools installed by administrators. But anyone can register a GitHub App, install it on a repository they control, and use its token to open an issue on any public repository. The action saw a bot name and let the content through. Agent mode lacked the additional human-actor verification that tag mode performed, leaving it fully exposed.

Once past the gate, the attacker uses indirect prompt injection, planting instructions inside content that Claude reads as data but executes as commands. RyotaK crafted an issue body disguised as an error recovery message. Claude “recovered” by running the commands buried inside, reading /proc/self/environ despite Claude Code’s built-in guards against that exact operation, and posting the values to the issue.

A second path, no bot required

RyotaK also identified a softer route that bypassed the bot trick entirely. Anthropic’s own example issue-triage workflow shipped with the setting allowed_non_write_users: “*”, which permits anyone to trigger the action. Anthropic’s documentation already flagged this as risky, but many repositories copied the example and inherited the configuration.

Worse, Claude was posting task summaries to the workflow run’s publicly visible summary panel, creating a ready-made exfiltration channel. A third variant targeted race conditions: edit a trusted user’s issue after the workflow fires but before Claude reads it, and the malicious payload rides in as trusted input.

Not theoretical

The same pattern, an AI issue triager combined with broad permissions and prompt injection, has already caused real damage. In February, a prompt-injected issue title against Cline’s claude-code-action triage workflow let attackers steal an npm publish token and push an unauthorised [email protected]. The rogue version force-installed a separate AI agent called OpenClaw on roughly 4,000 developer systems during an eight-hour window before being pulled.

An autonomous bot called HackerBot-Claw then spent late February probing GitHub Actions misconfigurations at Microsoft, Datadog, and CNCF projects. When it tried to prompt-inject a Claude-based reviewer through a poisoned config file, Claude caught it and refused. That is both reassuring and concerning: the model’s defences are inconsistent enough that the same class of attack sometimes succeeds and sometimes fails.

Fifty bypasses and counting

RyotaK says he has now reported approximately 50 separate ways to bypass Claude Code’s permission system and execute commands. The finding is part of a broader wave of supply chain attacks targeting AI-powered developer tools, from the poisoned VS Code extension that breached GitHub’s own repositories to malicious npm packages designed to harvest credentials from AI coding assistants.

The remediation is straightforward: update to claude-code-action v1.0.94 or later, audit any workflow that allows non-write users or bots to trigger Claude, strip unnecessary secrets from the environment, and remove tools and permissions that could be used for exfiltration.

The deeper problem is structural. Prompt injection remains unsolved. An AI agent with real tools and real tokens can be pushed as far as its permissions allow, and the permissions most organisations grant by default are far broader than the attack surface they are prepared to defend.



Source link

Leave a Reply

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.

This coin-sized flash drive gives my laptop double the storage space – and it’s $25 off

Europol Disrupts StealC and Amadey Malware Infrastructure in Operation Endgame

Why Frontier AI makes prioritization the most important part of your CTEM program

Cisco Unified CM Flaw CVE-2026-20230 Actively Exploited in the Wild

Ghost CMS flaw abused to push ClickFix attacks on hundreds of sites

Europol Disrupts StealC and Amadey Malware Infrastructure in Operation Endgame

Why Frontier AI makes prioritization the most important part of your CTEM program

Cisco Unified CM Flaw CVE-2026-20230 Actively Exploited in the Wild

Apple WWDC: What tech fans got right (and wrong) about iOS 27, Tim Cook, and more

Europol Disrupts StealC and Amadey Malware Infrastructure in Operation Endgame

Why Frontier AI makes prioritization the most important part of your CTEM program

Cisco Unified CM Flaw CVE-2026-20230 Actively Exploited in the Wild

Recent Reviews

Ghost CMS flaw abused to push ClickFix attacks on hundreds of sites


Ghost CMS flaw abused to push ClickFix attacks on hundreds of sites

Pierluigi Paganini
May 25, 2026

Threat actors are actively exploiting a security flaw, tracked as CVE-2026-26980, in Ghost CMS that was fixed months ago in real attacks against unpatched websites. According to Qianxin, the campaign has already affected more than 700 sites, including well-known organizations and universities.

The vulnerability is an SQL injection issue in Ghost’s Content API that can let an attacker read data from the database without logging in. In the worst case, this can expose the Admin API key, which can allow attackers to take over the site.

That key matters because it can be used to change published content. In this campaign, attackers used it to edit articles on compromised Ghost sites and insert malicious JavaScript at the end of pages. The goal was not just defacement, but to turn trusted websites into launch points for further malware delivery.

“After an in-depth investigation and analysis, we determined that this was not a targeted intrusion against the customer, but rather a large-scale poisoning campaign by an in-the-wild attack group targeting Ghost CMS. Although CVE-2026-26980 was publicly disclosed as early as February 19, a large number of users did not patch and upgrade in time, providing an opportunity for attackers.” reads the advisory published by Qianxin. “At least two groups are currently actively conducting such poisoning operations, and some sites have even become the target of competition between the two parties, with different malicious code being implanted one after another within a single day.”

The inserted code led visitors through a two-step chain. First, the page loaded a remote script that checked the browser and decided what the visitor should see. Then real victims were redirected to a fake verification page that looked like a normal “I’m human” check.

This is where the ClickFix part began. The page told users to press Windows+R, paste a command, and hit Enter. In practice, that command downloaded and started a malware payload on the victim’s machine. It was a classic social engineering trick: make the user do the dangerous part themselves.

Qianxin says the first signs of this activity appeared in early May. The malicious code found in the campaign had a compilation date of February 16, the same day Ghost announced the fix for CVE-2026-26980. That suggests the attackers moved quickly once they saw how many sites had not been updated.

The affected websites cover a wide range of sectors. Roughly half are personal blogs or independent sites, but the list also includes technology blogs, AI sites, media outlets, crypto projects, and educational institutions. Qianxin researchers say victims include sites linked to Harvard, Oxford, and DuckDuckGo.

The attack chain was also designed to be flexible. The loaders could fetch different payloads depending on the target, and the operators changed infrastructure several times.

“entire attack process has obvious five-stage characteristics of “CMS Takeover → Page Poisoning → Two-stage Loading → Social Engineering Lure (FakeCaptcha/ClickFix) → Malware Delivery”, and the entire process is highly automated: bulk vulnerability scanning → automatic key extraction → bulk injection → dynamic C2 distribution.” states the report.

In some cases, they switched domains after detection, keeping the campaign alive even when part of the chain was blocked.

“Through feature scanning of publicly accessible pages, we have cumulatively identified more than 700 poisoned victim domains, and have proactively contacted the sites for which contact information could be obtained, notifying them of the poisoning.” continues the report.

Qianxin also believes at least two different groups are involved. In some cases, the same site was hit more than once, with one attacker replacing the code left by another. That makes the campaign harder to clean up and shows how attractive compromised Ghost sites have become for abuse.

For site owners, the advice is straightforward. Ghost should be updated immediately, all credentials should be rotated, and site logs should be reviewed for suspicious admin API activity. Any injected scripts should be removed from the database itself, not just from the visual editor. Visitors who may have reached a poisoned site should also be warned.

The report includes Indicators of Compromise (IoCs) for the attacks observed by the researchers.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Ghost CMS)





Source link

Ghost CMS flaw abused to push ClickFix attacks on hundreds of sites

Third-Party Cyberattack Impacts Patient Information at The Oncology Institute

Lazarus APT unveils fileless RAT designed to evade detection

Copyright © 2024 All Rights Reserved.