Claude Code GitHub Action, in agent mode, trusted any GitHub App actor (a name ending in [bot]): a route from a public issue to repository write access, reported January 2026

Changes to what this case says, with the reason. Every earlier version is kept.

• 2026-10-21: Inference: signed by. The interpretation's wording changed after the editor signed it (second, independent check of 21 october 2026); the signature is cleared so the editor signs the corrected wording.
  Show the change

  Before: Saurabh Bhatnagar

  After:
• 2026-10-21: Inference: value. Found in the editor's second, independent check of the interpretations, 21 october 2026: the paragraph dropped the 'agent mode' limit kept by the title, the decision field and control c-a1; tag mode had a check that blocked github apps (flatt: 'agent mode lacked this check at the time of discovery'; the action's code at tag v1.0.29).
  Show the change

  Before: Kia's dealer portal let anyone register as a dealer and then granted dealer authority; this action let any GitHub App, which anyone can create, pass its write-permission check. In both, membership in a class anyone could join was treated as authorization, and nothing checked the actor's actual standing: a real dealership, or write permission on the repository

  After: Kia's dealer portal let anyone register as a dealer and then granted dealer authority; this action, in agent mode, let any GitHub App, which anyone can create, pass its write-permission check. In both, membership in a class anyone could join was treated as authorization, and nothing checked the actor's actual standing: a real dealership, or write permission on the repository
• 2026-10-21: Outcome: regime consequence. Editor's classification call of 21 october 2026 (call 6, accepted from pull request #74): keep the score, qualified as field f7 already states it: anthropic's bug-bounty rating of the reported issues as a set, cvss version 4.0, per the researcher; no public advisory or cve exists.
  Show the change

  Before: CVSS 7.8; patch v1.0.30 (16 January 2026); all reported issues fixed in v1.0.94

  After: CVSS 7.8 (Anthropic's bug-bounty rating of the reported issues as a set, per the researcher; no public advisory or CVE); patch v1.0.30 (16 January 2026); all reported issues fixed in v1.0.94
• 2026-10-20: Provenance tier text. Found in the editor's source re-check of 19-20 october 2026: the 7.8 score is the researcher's report of anthropic's rating of the reported issues as a set under cvss version 4.0; no advisory or cve publishes it.
  Show the change

  Before: Researcher disclosure; vendor fix; CVSS 7.8

  After: Researcher disclosure; vendor fix; CVSS 7.8 (Anthropic's bug-bounty rating, as reported by the researcher)
• 2026-10-20: Inference: value. Found in the editor's source re-check of 19-20 october 2026: the flatt post shows the actor really was a github app, correctly detected; the failure was that any github app passed 'regardless of its actual permissions', an authorization failure, not a failed identity check on a naming convention. the interpretation was signed by the editor on 2026-10-19; signed_by and signed_on are set to null and the editor must sign the new wording.
  Show the change

  Before: Kia's dealer portal trusted a role; this action trusted a naming convention (a name ending in [bot]). In both, the authority was real and the identity check was not

  After: Kia's dealer portal let anyone register as a dealer and then granted dealer authority; this action let any GitHub App, which anyone can create, pass its write-permission check. In both, membership in a class anyone could join was treated as authorization, and nothing checked the actor's actual standing: a real dealership, or write permission on the repository
• 2026-10-20: Outcome: regime consequence. Found in the editor's source re-check of 19-20 october 2026: the four-day fix shipped in v1.0.30 (vendor repository tag of 16 january 2026); v1.0.94 is the version as of which all reported issues were fixed (flatt post). the score itself is left pending an editor classification call.
  Show the change

  Before: CVSS 7.8; patch v1.0.94

  After: CVSS 7.8; patch v1.0.30 (16 January 2026); all reported issues fixed in v1.0.94
• 2026-10-20: Controls: c-a1. Found in the editor's source re-check of 19-20 october 2026: 'explicit allow-list of permitted bots (absent)' is contradicted by the vendor's repository: allowed_bots was added in august 2025 (commit fec554f) and the fix commit 1bbc9e7 extended the existing checkhumanactor/allowed_bots check to agent mode; the flatt post says tag mode already had the check.
  Show the change

  Before: Actor trust by naming convention; Explicit allow-list of permitted bots (absent)

  After: In agent mode any GitHub App passed the write-permission check regardless of its actual permissions; the allowed_bots allow-list (in the action since August 2025) and the actor-type check were enforced in tag mode but not in agent mode until the 16 January 2026 fix
• 2026-10-20: Fields: recovery technical. Found in the editor's source re-check of 19-20 october 2026: the four-day fix shipped in v1.0.30, not v1.0.94 (vendor repository); the flatt post does not recommend 'explicit allow-lists over broad trust in bots', it recommends auditing allowed_non_write_users and restricting permissions and secrets; the fix commit message says bots are rejected 'unless explicitly allowed via allowed_bots'.
  Show the change

  Before: Patch in v1.0.94; the researcher recommends explicit allow-lists over broad trust in bots

  After: Fix on 16 January 2026 (v1.0.30): agent mode now checks the actor's type and rejects non-human actors unless listed in the action's existing allowed_bots allow-list. Later remediation, complete as of v1.0.94: the workflow run summary disabled by default, a wrapper that blocks exfiltration through the gh command, environment variables scrubbed from child processes, and issues or comments edited after a run is triggered ignored. The researcher recommends auditing workflows for allowed_non_write_users and restricting their permissions and secrets
• 2026-10-20: Fields: evidence event: source ids. Found in the editor's source re-check of 19-20 october 2026: 'later press coverage' is the hacker news (now source thn) and 'fix in a released version' is the vendor's repository (cca_fix); both now cited.
  Show the change

  Before: ["THN"] (the id since renamed FLATT)

  After: ["CCA_FIX", "FLATT", "THN"]
• 2026-10-20: Fields: outcome. Found in the editor's source re-check of 19-20 october 2026: the flatt timeline dates the fix to 16 january 2026 and links commit 1bbc9e7, which the vendor's repository first released in tag v1.0.30; v1.0.94 (tag dated 13 april 2026) is the version 'as of' which all reported issues were fixed. the cvss 7.8 rating is the researcher's report of anthropic's bug-bounty rating of the issues as a set; no advisory or cve was found. sources cca_fix and thn added to the citation.
  Show the change

  Before: State: averted by disclosure. Reported by GMO Flatt Security on 12 January 2026; fixed four days later, in v1.0.94; further hardening through spring 2026 (researcher's timeline). Separately, in February 2026 a researcher showed that a prompt-injected issue title against a Cline triage workflow built on the same action could expose publish credentials; an unrevoked package-publishing token was later used to push an unauthorized Cline release, presumably by someone reusing the technique

  After: State: averted by disclosure. Reported by GMO Flatt Security on 12 January 2026; the permission bypass was fixed four days later, on 16 January 2026, in v1.0.30 (commit 1bbc9e7); all reported issues were fixed as of v1.0.94 (13 April 2026), after several rounds of remediation and follow-up bypasses through spring 2026 (researcher's timeline). Anthropic rated the reported issues, as a set, 7.8 under CVSS version 4.0, a severity score, per the researcher; no public advisory or CVE exists. Separately, in February 2026 a researcher showed that a prompt-injected issue title against a Cline triage workflow built on the same action could expose publish credentials; an unrevoked package-publishing token was later used to push an unauthorized Cline release, presumably by someone reusing the technique
• 2026-10-20: Fields: decision. Found in the editor's source re-check of 19-20 october 2026: the flatt post presents the permissive allowed_non_write_users setting as a separate route 'without needing the github app bypass at all'; the github app route alone reached write access. the earlier sentence merged the two routes.
  Show the change

  Before: The permission check treated any GitHub App actor, including names ending in [bot], as trusted; the agent then followed the issue's instructions to read its own process environment. The researcher's full route to write access also relied on a permissive triage-workflow configuration

  After: In agent mode the permission check passed any GitHub App actor (a name ending in [bot]) regardless of its actual permissions; tag mode had a further check of the actor's type that agent mode lacked. The agent then followed the issue's instructions to read its own process environment. The researcher separately described a second route, needing no GitHub App at all, through a permissive triage-workflow setting (allowed_non_write_users: "*") that lets any user trigger the workflow
• 2026-10-20: Fields: inputs. Found in the editor's source re-check of 19-20 october 2026: the flatt post does not say the attacker chose a name ending in [bot]; it says any github app can file issues on a public repository and the check tested for the [bot] suffix that github app actors carry.
  Show the change

  Before: A GitHub issue written to resemble an error message, filed by a GitHub App the attacker registered so its name ended in [bot]

  After: A GitHub issue written to resemble an error message, filed through a GitHub App the attacker created (GitHub App actors carry names ending in [bot])
• 2026-10-20: Fields: actor status. Found in the editor's source re-check of 19-20 october 2026: the flatt post says the trigger came from an attacker-created github app's installation token, not from the researcher's user account.
  Show the change

  Before: The action, acting on a trigger from an actor it mis-trusted (the researcher's account)

  After: The action, acting on a trigger from an actor it mis-trusted (a GitHub App the researcher created)
• 2026-10-20: Context: actors: text. Found in the editor's source re-check of 19-20 october 2026: the flatt post describes a real github app ('create a github app ... install it on the attacker's own repository'), correctly detected as an app, not a false bot.
  Show the change

  Before: 1 action; attacker as a false bot

  After: 1 action; attacker acting through a GitHub App of their own
• 2026-10-20: Title. Found in the editor's source re-check of 19-20 october 2026: the flatt post says the check 'unconditionally allows any github app to pass, regardless of its actual permissions' and that 'agent mode lacked this check at the time of discovery'; the flaw is past, fixed on 16 january 2026, and tag mode had the check.
  Show the change

  Before: Claude Code GitHub Action trusts any actor whose name ends in [bot]: a route from a public issue to repository write access, reported January 2026

  After: Claude Code GitHub Action, in agent mode, trusted any GitHub App actor (a name ending in [bot]): a route from a public issue to repository write access, reported January 2026
• 2026-10-20: Sources: thn. Found in the editor's source re-check of 19-20 october 2026: the source filed as thn is the gmo flatt security research post, not the hacker news; its id now names what it is (flatt) and every field, control and the interpretation that cited thn now cites flatt.
  Show the change

  Before: {"title": "GMO Flatt Security (RyotaK), 'Poisoning Claude Code: One GitHub Issue to Break the Supply Chain' (researcher disclosure; The Hacker News covered it 4 Jun 2026: https://thehackernews.com/2026/06/claude-code-github-action-flaw-let-one.html)", "type": "researcher", "url": "https://flatt.tech/research/posts/poisoning-claude-code-one-github-issue-to-break-the-supply-chain/", "via_press": false, "date": "2026-06-01", "tier": "disclosure_corroborated", "interest": null, "primary": true, "checked": "2026-10-13"}

  After: renamed to sources.FLATT; title set to the post's exact headline
• 2026-10-16: Controls. Found in an outside review of the published record on 16 october 2026: repeated entries showed the same control twice on the page.
  Show the change

  Before: the same control listed more than once in one state

  After: one entry per control, notes combined
• 2026-10-13: Fields and sources. Source typing corrected on review; no vendor or regulator record was found to support fact typing.
  Show the change

  Before: facts cited The Hacker News typed as regulator; Cline incident stated as established

  After: claims cite the researcher's own disclosure, typed as researcher assertions in the absence of a vendor advisory; the Cline incident described as the researcher and Cline's advisory record it
• 2026-10-13: Context: jurisdiction. Jurisdiction text was split at a comma inside parentheses.
  Show the change

  Before: Global (vendor in the United States | researcher in Japan)

  After: Global (vendor in the United States, researcher in Japan)
• 2026-10-13: Controls: c-a1. A control has one state per case; entries in two states merged into the state the record supports.
  Show the change

  Before: failed: Actor trust by naming convention; absent: Explicit allow-list of permitted bots

  After: failed: Actor trust by naming convention; Explicit allow-list of permitted bots (absent)