Microsoft Discloses Claude Code Flaw That Could Leak CI/CD Secrets

Researchers from Microsoft Threat Intelligence showed that Anthropic's Claude Code GitHub Action tool could be tricked into extracting confidential authentication data from a CI/CD pipeline itself. All it took was hiding a properly crafted instruction in the body of a GitHub issue for the AI agent to read environment variables containing API keys.

How the Attack Worked

The mechanism relied on classic prompt injection, hiding instructions for the AI model inside content that a human reads as harmless. Researchers prepared an example disguised as a compliance review request, instructing the agent to access the /proc/self/environ file and trim the output by seven characters to bypass the model's safety filters and GitHub's automatic secret scanner.

The fake instruction was placed in the body of a GitHub issue or a pull request description. A human reviewing that content saw nothing suspicious, but the AI agent processing the raw markdown text read the hidden instruction as a command to execute. In some variants of the attack, the code fragment was even hidden inside an HTML comment, invisible in GitHub's rendered view.

A Gap in the Tool Architecture

The core of the problem lay in inconsistent treatment of the different tools available to the agent. The Bash tool, used to run shell commands, operated inside a sandbox that stripped environment variables before executing code. The Read tool, responsible for reading files, had no equivalent safeguard and let the agent reach directly into system files containing sensitive runtime environment data.

The Read tool is not subject to the same isolation [as the Bash tool] - Microsoft Defender Security Research Team

In practice, this meant an attacker could bypass the safeguards without running any suspicious shell command at all, using only the legitimate file-reading function the agent already had available in its normal mode of operation.

The Scale of Risk for Companies

Microsoft stressed that secrets stolen this way, for example API keys for Anthropic or repository access tokens, could be used to impersonate an entire CI/CD workflow, burn compute resources at the victim's expense, or gain deeper access to a company's connected systems. Because Claude Code Action is sometimes connected directly to production repositories, the consequences of a leak could extend well beyond a single build pipeline.

The company proposed a principle called the Agents Rule of Two: no AI agent-based workflow should simultaneously process untrusted input, have access to secrets, and perform actions that change system state or communicate externally. Meeting all three conditions at once, according to the researchers, opens the door to similar attacks regardless of the specific model provider.

What's Next for Development Teams

Microsoft recommended that developers using coding agents in CI/CD apply the principle of least privilege to every token and API key, create separate keys for each environment and workflow, explicitly mark in system prompts which data sources are untrusted, and limit each workflow to a single, tightly scoped task. It also recommended monitoring API usage patterns at the model provider level, which can catch unusual activity before a leak occurs.

For Polish development teams, which are increasingly connecting Claude Code, Codex, and other coding agents directly to GitHub repositories, the case is a signal that automatic AI processing of issues and pull requests needs to be treated with the same caution as any other untrusted external input. The mere presence of a sandbox for one of an agent's tools does not guarantee that the agent's other tools are equally well secured.

Anthropic responded relatively quickly, publishing a fix just a few days after Microsoft's report, well before the vulnerability's details were disclosed publicly. This responsible-disclosure pattern, with a month-long gap between the patch and the technical write-up, is standard practice in the security industry and was meant to give users time to update before knowledge of the attack method became widespread.

The case adds to a growing list of incidents showing that AI coding agents connected to real repositories and deployment pipelines represent a new attack surface, distinct from classic web threats. As more companies automate code review and issue handling with such tools, similar gaps in permission separation between an agent's individual functions could turn up at other providers as well.