{
 "schema_version": "0.4",
 "id": "REG-0024",
 "title": "Claude Code GitHub Action, in agent mode, trusted any GitHub App actor (a name ending in [bot]): a route from a public issue to repository write access, reported January 2026",
 "batch": "B2",
 "family": "software",
 "context": {
  "domain": "Software agent in a software supply chain (CI)",
  "autonomy_level": "supervised",
  "actor_type": "Software: the Claude Code GitHub Action",
  "actors": {
   "count": 1,
   "text": "1 action; attacker acting through a GitHub App of their own",
   "roles": [
    "defender"
   ]
  },
  "mandate_context": "demonstration",
  "jurisdiction": [
   "Global (vendor in the United States, researcher in Japan)"
  ],
  "autonomy_level_text": "Machine acts on repository events",
  "mandate_context_text": "Demonstration"
 },
 "provenance_tier": "disclosure_corroborated",
 "status": "confirmed",
 "fields": [
  {
   "layer": "Mandate",
   "facet": "principal",
   "value": "A repository maintainer running the action on issues and pull requests",
   "assertion_type": "assertion",
   "source_ids": [
    "FLATT"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Actor",
   "facet": "status",
   "value": "The action, acting on a trigger from an actor it mis-trusted (a GitHub App the researcher created)",
   "assertion_type": "assertion",
   "source_ids": [
    "FLATT"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Inputs",
   "facet": null,
   "value": "A GitHub issue written to resemble an error message, filed through a GitHub App the attacker created (GitHub App actors carry names ending in [bot])",
   "assertion_type": "assertion",
   "source_ids": [
    "FLATT"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Decision",
   "facet": null,
   "value": "In agent mode the permission check passed any GitHub App actor (a name ending in [bot]) regardless of its actual permissions; tag mode had a further check of the actor's type that agent mode lacked. The agent then followed the issue's instructions to read its own process environment. The researcher separately described a second route, needing no GitHub App at all, through a permissive triage-workflow setting (allowed_non_write_users: \"*\") that lets any user trigger the workflow",
   "assertion_type": "assertion",
   "source_ids": [
    "FLATT"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Envelope",
   "facet": "authority",
   "value": "The action's environment held credentials that could be exchanged for a write-capable token",
   "assertion_type": "assertion",
   "source_ids": [
    "FLATT"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Action",
   "facet": null,
   "value": "Extraction of environment variables and an identity token; replay for write access to code, issues, and workflows",
   "assertion_type": "assertion",
   "source_ids": [
    "FLATT"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Outcome",
   "facet": null,
   "value": "State: averted by disclosure. Reported by GMO Flatt Security on 12 January 2026; the permission bypass was fixed four days later, on 16 January 2026, in v1.0.30 (commit 1bbc9e7); all reported issues were fixed as of v1.0.94 (13 April 2026), after several rounds of remediation and follow-up bypasses through spring 2026 (researcher's timeline). Anthropic rated the reported issues, as a set, 7.8 under CVSS version 4.0, a severity score, per the researcher; no public advisory or CVE exists. Separately, in February 2026 a researcher showed that a prompt-injected issue title against a Cline triage workflow built on the same action could expose publish credentials; an unrevoked package-publishing token was later used to push an unauthorized Cline release, presumably by someone reusing the technique.",
   "assertion_type": "assertion",
   "source_ids": [
    "CCA_FIX",
    "CLINE",
    "FLATT",
    "THN"
   ],
   "confidence": "medium",
   "disputed": false
  },
  {
   "layer": "Evidence",
   "facet": "event",
   "value": "Researcher disclosure with a dated timeline; fix in a released version; later press coverage",
   "assertion_type": "assertion",
   "source_ids": [
    "CCA_FIX",
    "FLATT",
    "THN"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Recovery",
   "facet": "technical",
   "value": "Fix on 16 January 2026 (v1.0.30): agent mode now checks the actor's type and rejects non-human actors unless listed in the action's existing allowed_bots allow-list. Later remediation, complete as of v1.0.94: the workflow run summary disabled by default, a wrapper that blocks exfiltration through the gh command, environment variables scrubbed from child processes, and issues or comments edited after a run is triggered ignored. The researcher recommends auditing workflows for allowed_non_write_users and restricting their permissions and secrets",
   "assertion_type": "assertion",
   "source_ids": [
    "CCA_FIX",
    "FLATT"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Recovery",
   "facet": "accountability",
   "value": "Coordinated disclosure",
   "assertion_type": "assertion",
   "source_ids": [
    "FLATT"
   ],
   "confidence": "high",
   "disputed": false
  }
 ],
 "controls": {
  "failed": [
   {
    "id": "C-E1",
    "note": "Process-environment exposure to the agent",
    "confidence": "medium",
    "basis": "curated"
   },
   {
    "id": "C-A1",
    "note": "In agent mode any GitHub App passed the write-permission check regardless of its actual permissions; the allowed_bots allow-list (in the action since August 2025) and the actor-type check were enforced in tag mode but not in agent mode until the 16 January 2026 fix",
    "confidence": "high",
    "basis": "curated"
   }
  ],
  "succeeded": [
   {
    "id": "C-O1",
    "note": "Coordinated disclosure; Four-day patch",
    "confidence": "high",
    "basis": "curated"
   }
  ],
  "absent": [
   {
    "id": "C-I1",
    "note": "Issue text resembling an error message treated as instruction",
    "confidence": "high",
    "basis": "reviewer 2026-10-06"
   }
  ]
 },
 "applicable_rules": [
  "None applicable; platform security guidance"
 ],
 "unmapped": [],
 "corrections": [
  {
   "date": "2026-10-13",
   "field": "controls.C-A1",
   "old": "failed: Actor trust by naming convention; absent: Explicit allow-list of permitted bots",
   "new": "failed: Actor trust by naming convention; Explicit allow-list of permitted bots (absent)",
   "reason": "a control has one state per case; entries in two states merged into the state the record supports"
  },
  {
   "date": "2026-10-13",
   "field": "context.jurisdiction",
   "old": "Global (vendor in the United States | researcher in Japan)",
   "new": "Global (vendor in the United States, researcher in Japan)",
   "reason": "jurisdiction text was split at a comma inside parentheses"
  },
  {
   "date": "2026-10-13",
   "field": "fields and sources",
   "old": "facts cited The Hacker News typed as regulator; Cline incident stated as established",
   "new": "claims cite the researcher's own disclosure, typed as researcher assertions in the absence of a vendor advisory; the Cline incident described as the researcher and Cline's advisory record it",
   "reason": "source typing corrected on review; no vendor or regulator record was found to support fact typing"
  },
  {
   "date": "2026-10-14",
   "field": "reviewed_by",
   "old": "none",
   "new": "Saurabh Bhatnagar (editor)",
   "reason": "case checked by the editor against its linked records"
  },
  {
   "date": "2026-10-14",
   "field": "named_parties[Anthropic].right_of_reply",
   "old": "{\"offered\": null, \"response\": null}",
   "new": "{\"offered\": \"2026-10-14\", \"response\": null}",
   "reason": "right of reply offered by email from register@secureautonomous.com to press@anthropic.com on 14 October 2026, in one letter covering REG-0011, REG-0023 and REG-0024 (confirmed in the Sent folder); recorded at the editor's instruction"
  },
  {
   "date": "2026-10-16",
   "field": "inference.value",
   "old": "Kia trusted a role (dealer); this action trusted a naming convention ([bot]). Both are Actor failures where the authority was real and the identity check was not",
   "new": "Kia's dealer portal trusted a role; this action trusted a naming convention (a name ending in [bot]). In both, the authority was real and the identity check was not.",
   "reason": "Reworded for readers before the editor's sign-off, after an outside review found it read as internal notes; the interpretation itself is unchanged"
  },
  {
   "date": "2026-10-16",
   "field": "controls",
   "old": "the same control listed more than once in one state",
   "new": "one entry per control, notes combined",
   "reason": "Found in an outside review of the published record on 16 October 2026: repeated entries showed the same control twice on the page"
  },
  {
   "date": "2026-10-19",
   "field": "named_parties[GMO Flatt Security].right_of_reply",
   "old": "{\"offered\": null, \"response\": null}",
   "new": "{\"offered\": \"2026-10-19\", \"response\": null}",
   "reason": "Right of reply offered to GMO Flatt Security through its website contact form (flatt.tech/en/contact; it publishes no email address), submitted by the editor on 19 October 2026; recorded at the editor's instruction"
  },
  {
   "date": "2026-10-20",
   "field": "sources.THN",
   "old": "{\"title\": \"GMO Flatt Security (RyotaK), 'Poisoning Claude Code: One GitHub Issue to Break the Supply Chain' (researcher disclosure; The Hacker News covered it 4 Jun 2026: https://thehackernews.com/2026/06/claude-code-github-action-flaw-let-one.html)\", \"type\": \"researcher\", \"url\": \"https://flatt.tech/research/posts/poisoning-claude-code-one-github-issue-to-break-the-supply-chain/\", \"via_press\": false, \"date\": \"2026-06-01\", \"tier\": \"disclosure_corroborated\", \"interest\": null, \"primary\": true, \"checked\": \"2026-10-13\"}",
   "new": "renamed to sources.FLATT; title set to the post's exact headline",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the source filed as THN is the GMO Flatt Security research post, not The Hacker News; its id now names what it is (FLATT) and every field, control and the interpretation that cited THN now cites FLATT"
  },
  {
   "date": "2026-10-20",
   "field": "sources.THN",
   "old": null,
   "new": "{\"title\": \"Claude Code GitHub Action Flaw Let One Malicious Issue Hijack Repositories (The Hacker News, Swati Khandelwal)\", \"type\": \"press_pointer\", \"url\": \"https://thehackernews.com/2026/06/claude-code-github-action-flaw-let-one.html\", \"via_press\": true, \"date\": \"2026-06-04\", \"tier\": \"disclosure_corroborated\", \"interest\": null, \"primary\": false, \"checked\": \"2026-10-20\"}",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: The Hacker News article of 4 June 2026 by Swati Khandelwal, previously folded into the researcher source's title, is now a separate press source"
  },
  {
   "date": "2026-10-20",
   "field": "sources.CCA_FIX",
   "old": null,
   "new": "{\"title\": \"anthropics/claude-code-action on GitHub: commit 1bbc9e7, 'fix: add checkHumanActor to agent mode (#826)', 15 January 2026; first released in tag v1.0.30 (16 January 2026); tag v1.0.94 dated 13 April 2026\", \"type\": \"company\", \"url\": \"https://github.com/anthropics/claude-code-action/commit/1bbc9e7ff7d48e1299f7fa9698273d248e0cafea\", \"via_press\": false, \"date\": \"2026-01-15\", \"tier\": \"company\", \"interest\": \"vendor's own repository\", \"primary\": true, \"checked\": \"2026-10-20\"}",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the vendor's repository is the primary record for version numbers: commit 1bbc9e7 (linked from the Flatt post as the fix) is first contained in tag v1.0.30 (16 January 2026); tag v1.0.94 is dated 13 April 2026"
  },
  {
   "date": "2026-10-20",
   "field": "title",
   "old": "Claude Code GitHub Action trusts any actor whose name ends in [bot]: a route from a public issue to repository write access, reported January 2026",
   "new": "Claude Code GitHub Action, in agent mode, trusted any GitHub App actor (a name ending in [bot]): a route from a public issue to repository write access, reported January 2026",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the Flatt post says the check 'unconditionally allows any GitHub App to pass, regardless of its actual permissions' and that 'agent mode lacked this check at the time of discovery'; the flaw is past, fixed on 16 January 2026, and tag mode had the check"
  },
  {
   "date": "2026-10-20",
   "field": "context.actors.text",
   "old": "1 action; attacker as a false bot",
   "new": "1 action; attacker acting through a GitHub App of their own",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the Flatt post describes a real GitHub App ('Create a GitHub App ... Install it on the attacker's own repository'), correctly detected as an app, not a false bot"
  },
  {
   "date": "2026-10-20",
   "field": "fields.Actor status",
   "old": "The action, acting on a trigger from an actor it mis-trusted (the researcher's account)",
   "new": "The action, acting on a trigger from an actor it mis-trusted (a GitHub App the researcher created)",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the Flatt post says the trigger came from an attacker-created GitHub App's installation token, not from the researcher's user account"
  },
  {
   "date": "2026-10-20",
   "field": "fields.Inputs",
   "old": "A GitHub issue written to resemble an error message, filed by a GitHub App the attacker registered so its name ended in [bot]",
   "new": "A GitHub issue written to resemble an error message, filed through a GitHub App the attacker created (GitHub App actors carry names ending in [bot])",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the Flatt post does not say the attacker chose a name ending in [bot]; it says any GitHub App can file issues on a public repository and the check tested for the [bot] suffix that GitHub App actors carry"
  },
  {
   "date": "2026-10-20",
   "field": "fields.Decision",
   "old": "The permission check treated any GitHub App actor, including names ending in [bot], as trusted; the agent then followed the issue's instructions to read its own process environment. The researcher's full route to write access also relied on a permissive triage-workflow configuration",
   "new": "In agent mode the permission check passed any GitHub App actor (a name ending in [bot]) regardless of its actual permissions; tag mode had a further check of the actor's type that agent mode lacked. The agent then followed the issue's instructions to read its own process environment. The researcher separately described a second route, needing no GitHub App at all, through a permissive triage-workflow setting (allowed_non_write_users: \"*\") that lets any user trigger the workflow",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the Flatt post presents the permissive allowed_non_write_users setting as a separate route 'without needing the GitHub App bypass at all'; the GitHub App route alone reached write access. The earlier sentence merged the two routes"
  },
  {
   "date": "2026-10-20",
   "field": "fields.Outcome",
   "old": "State: averted by disclosure. Reported by GMO Flatt Security on 12 January 2026; fixed four days later, in v1.0.94; further hardening through spring 2026 (researcher's timeline). Separately, in February 2026 a researcher showed that a prompt-injected issue title against a Cline triage workflow built on the same action could expose publish credentials; an unrevoked package-publishing token was later used to push an unauthorized Cline release, presumably by someone reusing the technique.",
   "new": "State: averted by disclosure. Reported by GMO Flatt Security on 12 January 2026; the permission bypass was fixed four days later, on 16 January 2026, in v1.0.30 (commit 1bbc9e7); all reported issues were fixed as of v1.0.94 (13 April 2026), after several rounds of remediation and follow-up bypasses through spring 2026 (researcher's timeline). Anthropic rated the reported issues, as a set, 7.8 under CVSS version 4.0, a severity score, per the researcher; no public advisory or CVE exists. Separately, in February 2026 a researcher showed that a prompt-injected issue title against a Cline triage workflow built on the same action could expose publish credentials; an unrevoked package-publishing token was later used to push an unauthorized Cline release, presumably by someone reusing the technique.",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the Flatt timeline dates the fix to 16 January 2026 and links commit 1bbc9e7, which the vendor's repository first released in tag v1.0.30; v1.0.94 (tag dated 13 April 2026) is the version 'as of' which all reported issues were fixed. The CVSS 7.8 rating is the researcher's report of Anthropic's bug-bounty rating of the issues as a set; no advisory or CVE was found. Sources CCA_FIX and THN added to the citation"
  },
  {
   "date": "2026-10-20",
   "field": "fields.Evidence event.source_ids",
   "old": "[\"THN\"] (the id since renamed FLATT)",
   "new": "[\"CCA_FIX\", \"FLATT\", \"THN\"]",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: 'later press coverage' is The Hacker News (now source THN) and 'fix in a released version' is the vendor's repository (CCA_FIX); both now cited"
  },
  {
   "date": "2026-10-20",
   "field": "fields.Recovery technical",
   "old": "Patch in v1.0.94; the researcher recommends explicit allow-lists over broad trust in bots",
   "new": "Fix on 16 January 2026 (v1.0.30): agent mode now checks the actor's type and rejects non-human actors unless listed in the action's existing allowed_bots allow-list. Later remediation, complete as of v1.0.94: the workflow run summary disabled by default, a wrapper that blocks exfiltration through the gh command, environment variables scrubbed from child processes, and issues or comments edited after a run is triggered ignored. The researcher recommends auditing workflows for allowed_non_write_users and restricting their permissions and secrets",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the four-day fix shipped in v1.0.30, not v1.0.94 (vendor repository); the Flatt post does not recommend 'explicit allow-lists over broad trust in bots', it recommends auditing allowed_non_write_users and restricting permissions and secrets; the fix commit message says bots are rejected 'unless explicitly allowed via allowed_bots'"
  },
  {
   "date": "2026-10-20",
   "field": "controls.C-A1",
   "old": "Actor trust by naming convention; Explicit allow-list of permitted bots (absent)",
   "new": "In agent mode any GitHub App passed the write-permission check regardless of its actual permissions; the allowed_bots allow-list (in the action since August 2025) and the actor-type check were enforced in tag mode but not in agent mode until the 16 January 2026 fix",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: 'Explicit allow-list of permitted bots (absent)' is contradicted by the vendor's repository: allowed_bots was added in August 2025 (commit fec554f) and the fix commit 1bbc9e7 extended the existing checkHumanActor/allowed_bots check to agent mode; the Flatt post says tag mode already had the check"
  },
  {
   "date": "2026-10-20",
   "field": "outcome.regime_consequence",
   "old": "CVSS 7.8; patch v1.0.94",
   "new": "CVSS 7.8; patch v1.0.30 (16 January 2026); all reported issues fixed in v1.0.94",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the four-day fix shipped in v1.0.30 (vendor repository tag of 16 January 2026); v1.0.94 is the version as of which all reported issues were fixed (Flatt post). The score itself is left pending an editor classification call"
  },
  {
   "date": "2026-10-20",
   "field": "inference.value",
   "old": "Kia's dealer portal trusted a role; this action trusted a naming convention (a name ending in [bot]). In both, the authority was real and the identity check was not.",
   "new": "Kia's dealer portal let anyone register as a dealer and then granted dealer authority; this action let any GitHub App, which anyone can create, pass its write-permission check. In both, membership in a class anyone could join was treated as authorization, and nothing checked the actor's actual standing: a real dealership, or write permission on the repository.",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the Flatt post shows the actor really was a GitHub App, correctly detected; the failure was that any GitHub App passed 'regardless of its actual permissions', an authorization failure, not a failed identity check on a naming convention. The interpretation was signed by the editor on 2026-10-19; signed_by and signed_on are set to null and the editor must sign the new wording"
  },
  {
   "date": "2026-10-20",
   "field": "provenance_tier_text",
   "old": "Researcher disclosure; vendor fix; CVSS 7.8",
   "new": "Researcher disclosure; vendor fix; CVSS 7.8 (Anthropic's bug-bounty rating, as reported by the researcher)",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the 7.8 score is the researcher's report of Anthropic's rating of the reported issues as a set under CVSS version 4.0; no advisory or CVE publishes it"
  },
  {
   "date": "2026-10-21",
   "field": "outcome.regime_consequence",
   "old": "CVSS 7.8; patch v1.0.30 (16 January 2026); all reported issues fixed in v1.0.94",
   "new": "CVSS 7.8 (Anthropic's bug-bounty rating of the reported issues as a set, per the researcher; no public advisory or CVE); patch v1.0.30 (16 January 2026); all reported issues fixed in v1.0.94",
   "reason": "Editor's classification call of 21 October 2026 (call 6, accepted from pull request #74): keep the score, qualified as field F7 already states it: Anthropic's bug-bounty rating of the reported issues as a set, CVSS version 4.0, per the researcher; no public advisory or CVE exists."
  },
  {
   "date": "2026-10-21",
   "field": "inference.value",
   "old": "Kia's dealer portal let anyone register as a dealer and then granted dealer authority; this action let any GitHub App, which anyone can create, pass its write-permission check. In both, membership in a class anyone could join was treated as authorization, and nothing checked the actor's actual standing: a real dealership, or write permission on the repository.",
   "new": "Kia's dealer portal let anyone register as a dealer and then granted dealer authority; this action, in agent mode, let any GitHub App, which anyone can create, pass its write-permission check. In both, membership in a class anyone could join was treated as authorization, and nothing checked the actor's actual standing: a real dealership, or write permission on the repository.",
   "reason": "Found in the editor's second, independent check of the interpretations, 21 October 2026: the paragraph dropped the 'agent mode' limit kept by the title, the Decision field and control C-A1; tag mode had a check that blocked GitHub Apps (Flatt: 'agent mode lacked this check at the time of discovery'; the action's code at tag v1.0.29)."
  },
  {
   "date": "2026-10-21",
   "field": "inference.signed_by",
   "old": "Saurabh Bhatnagar",
   "new": null,
   "reason": "The interpretation's wording changed after the editor signed it (second, independent check of 21 October 2026); the signature is cleared so the editor signs the corrected wording."
  },
  {
   "date": "2026-10-22",
   "field": "named_parties[Anthropic].right_of_reply",
   "old": "{\"offered\": \"2026-10-14\", \"response\": null, \"assessed_through\": \"2026-10-22\", \"assessments\": [{\"through\": \"2026-10-22\", \"date\": \"2026-10-22\", \"by\": \"editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering\", \"triggered\": [\"the permissive triage-workflow setting is now a separate second route to write access (Decision)\", \"the fixes took several rounds of remediation and follow-up bypasses, with all reported issues fixed only by 13 April 2026, and no public advisory or CVE exists (Outcome, consequence line)\"], \"note\": null}]}",
   "new": "{\"offered\": \"2026-10-14\", \"response\": null, \"assessed_through\": \"2026-10-22\", \"assessments\": [{\"through\": \"2026-10-22\", \"date\": \"2026-10-22\", \"by\": \"editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering\", \"triggered\": [\"the permissive triage-workflow setting is now a separate second route to write access (Decision)\", \"the fixes took several rounds of remediation and follow-up bypasses, with all reported issues fixed only by 13 April 2026, and no public advisory or CVE exists (Outcome, consequence line)\"], \"note\": null}], \"followups\": [{\"sent\": \"2026-10-22\", \"covers\": \"the permissive triage-workflow setting is now a separate second route to write access (Decision); the fixes took several rounds of remediation and follow-up bypasses, with all reported issues fixed only by 13 April 2026, and no public advisory or CVE exists (Outcome, consequence line)\"}]}",
   "reason": "right of reply recorded by a human"
  },
  {
   "date": "2026-10-28",
   "field": "named_parties[Anthropic].right_of_reply",
   "old": "{\"offered\": \"2026-10-14\", \"response\": null, \"assessed_through\": \"2026-10-22\", \"assessments\": [{\"through\": \"2026-10-22\", \"date\": \"2026-10-22\", \"by\": \"editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering\", \"triggered\": [\"the permissive triage-workflow setting is now a separate second route to write access (Decision)\", \"the fixes took several rounds of remediation and follow-up bypasses, with all reported issues fixed only by 13 April 2026, and no public advisory or CVE exists (Outcome, consequence line)\"], \"note\": null}], \"followups\": [{\"sent\": \"2026-10-22\", \"covers\": \"the permissive triage-workflow setting is now a separate second route to write access (Decision); the fixes took several rounds of remediation and follow-up bypasses, with all reported issues fixed only by 13 April 2026, and no public advisory or CVE exists (Outcome, consequence line)\"}]}",
   "new": "{\"offered\": \"2026-10-14\", \"response\": null, \"assessed_through\": \"2026-10-22\", \"assessments\": [{\"through\": \"2026-10-22\", \"date\": \"2026-10-22\", \"by\": \"editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering\", \"triggered\": [\"the permissive triage-workflow setting is now a separate second route to write access (Decision)\", \"the fixes took several rounds of remediation and follow-up bypasses, with all reported issues fixed only by 13 April 2026, and no public advisory or CVE exists (Outcome, consequence line)\"], \"note\": null}], \"followups\": [{\"sent\": \"2026-10-22\", \"covers\": \"the permissive triage-workflow setting is now a separate second route to write access (Decision); the fixes took several rounds of remediation and follow-up bypasses, with all reported issues fixed only by 13 April 2026, and no public advisory or CVE exists (Outcome, consequence line)\"}], \"no_response_as_of\": \"2026-10-28\"}",
   "reason": "right of reply recorded by a human"
  }
 ],
 "created": "2026-10-06",
 "last_reviewed": "2026-10-28",
 "actor_status": "confirmed",
 "provenance_tier_text": "Researcher disclosure; vendor fix; CVSS 7.8 (Anthropic's bug-bounty rating, as reported by the researcher)",
 "status_text": "Confirmed (demonstrated; no exploitation of this variant known)",
 "outcome": {
  "state": "averted_by_disclosure",
  "severity": "none (demonstration); separate February 2026 token theft at another project",
  "affected_parties": [],
  "cost": "none",
  "regime_consequence": "CVSS 7.8 (Anthropic's bug-bounty rating of the reported issues as a set, per the researcher; no public advisory or CVE); patch v1.0.30 (16 January 2026); all reported issues fixed in v1.0.94",
  "as_of": "Jun 2026",
  "derived_by": "backfill-curated"
 },
 "inference": {
  "value": "Kia's dealer portal let anyone register as a dealer and then granted dealer authority; this action, in agent mode, let any GitHub App, which anyone can create, pass its write-permission check. In both, membership in a class anyone could join was treated as authorization, and nothing checked the actor's actual standing: a real dealership, or write permission on the repository.",
  "source_ids": [
   "FLATT"
  ],
  "confidence": "high",
  "signed_by": "Saurabh Bhatnagar",
  "signed_on": "2026-10-21"
 },
 "named_parties": [
  {
   "name": "Anthropic",
   "right_of_reply": {
    "offered": "2026-10-14",
    "response": null,
    "assessed_through": "2026-10-22",
    "assessments": [
     {
      "through": "2026-10-22",
      "date": "2026-10-22",
      "by": "editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering",
      "triggered": [
       "the permissive triage-workflow setting is now a separate second route to write access (Decision)",
       "the fixes took several rounds of remediation and follow-up bypasses, with all reported issues fixed only by 13 April 2026, and no public advisory or CVE exists (Outcome, consequence line)"
      ],
      "note": null
     }
    ],
    "followups": [
     {
      "sent": "2026-10-22",
      "covers": "the permissive triage-workflow setting is now a separate second route to write access (Decision); the fixes took several rounds of remediation and follow-up bypasses, with all reported issues fixed only by 13 April 2026, and no public advisory or CVE exists (Outcome, consequence line)"
     }
    ],
    "no_response_as_of": "2026-10-28"
   }
  },
  {
   "name": "GMO Flatt Security",
   "right_of_reply": {
    "offered": "2026-10-19",
    "response": null,
    "assessed_through": "2026-10-22",
    "assessments": [
     {
      "through": "2026-10-22",
      "date": "2026-10-22",
      "by": "editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering",
      "triggered": [],
      "note": "no correction since the offer adds or worsens a claim about this party in words that are not its own"
     }
    ]
   }
  }
 ],
 "sources": {
  "CLINE": {
   "title": "Adnan Khan: Clinejection — Compromising Cline's Production Releases just by Prompting an Issue Triager",
   "type": "researcher",
   "url": "https://adnanthekhan.com/posts/clinejection/",
   "via_press": false,
   "date": "2026-02-09",
   "tier": "disclosure_corroborated",
   "interest": null,
   "primary": true,
   "checked": "2026-10-13"
  },
  "FLATT": {
   "title": "Poisoning Claude Code: One GitHub Issue to Break the Supply Chain (GMO Flatt Security research blog, RyotaK)",
   "type": "researcher",
   "url": "https://flatt.tech/research/posts/poisoning-claude-code-one-github-issue-to-break-the-supply-chain/",
   "via_press": false,
   "date": "2026-06-01",
   "tier": "disclosure_corroborated",
   "interest": null,
   "primary": true,
   "checked": "2026-10-20"
  },
  "THN": {
   "title": "Claude Code GitHub Action Flaw Let One Malicious Issue Hijack Repositories (The Hacker News, Swati Khandelwal)",
   "type": "press_pointer",
   "url": "https://thehackernews.com/2026/06/claude-code-github-action-flaw-let-one.html",
   "via_press": true,
   "date": "2026-06-04",
   "tier": "disclosure_corroborated",
   "interest": null,
   "primary": false,
   "checked": "2026-10-20"
  },
  "CCA_FIX": {
   "title": "anthropics/claude-code-action on GitHub: commit 1bbc9e7, 'fix: add checkHumanActor to agent mode (#826)', 15 January 2026; first released in tag v1.0.30 (16 January 2026); tag v1.0.94 dated 13 April 2026",
   "type": "company",
   "url": "https://github.com/anthropics/claude-code-action/commit/1bbc9e7ff7d48e1299f7fa9698273d248e0cafea",
   "via_press": false,
   "date": "2026-01-15",
   "tier": "company",
   "interest": "vendor's own repository",
   "primary": true,
   "checked": "2026-10-20"
  }
 },
 "derived_by": "backfill-curated",
 "reviewed_by": "Saurabh Bhatnagar (editor)",
 "dec_group": "direct",
 "ctl_names": [
  "Actor identity verification",
  "Least-privilege credential scoped to task",
  "Retrieved content as data"
 ]
}