Claude Code GitHub Action, in agent mode, trusted any GitHub App actor (a name ending in [bot]): a route from a public issue to repository write access, reported January 2026
The typed evidence object. This is the working store; the case page is the reader's form.
| Layer / facet | Value | Type | Sources | Conf. |
|---|---|---|---|---|
| Mandate: principal | A repository maintainer running the action on issues and pull requests | assertion | Poisoning Claude Code: One GitHub Issue to Break the Supply Chain (GMO Flatt Security research blog, RyotaK) | high |
| Actor: status | The action, acting on a trigger from an actor it mis-trusted (a GitHub App the researcher created) | assertion | Poisoning Claude Code: One GitHub Issue to Break the Supply Chain (GMO Flatt Security research blog, RyotaK) | high |
| Inputs | A GitHub issue written to resemble an error message, filed through a GitHub App the attacker created (GitHub App actors carry names ending in [bot]) | assertion | Poisoning Claude Code: One GitHub Issue to Break the Supply Chain (GMO Flatt Security research blog, RyotaK) | high |
| Decision | In agent mode the permission check passed any GitHub App actor (a name ending in [bot]) regardless of its actual permissions; tag mode had a further check of the actor's type that agent mode lacked. The agent then followed the issue's instructions to read its own process environment. The researcher separately described a second route, needing no GitHub App at all, through a permissive triage-workflow setting (allowed_non_write_users: "*") that lets any user trigger the workflow | assertion | Poisoning Claude Code: One GitHub Issue to Break the Supply Chain (GMO Flatt Security research blog, RyotaK) | high |
| Envelope: authority | The action's environment held credentials that could be exchanged for a write-capable token | assertion | Poisoning Claude Code: One GitHub Issue to Break the Supply Chain (GMO Flatt Security research blog, RyotaK) | high |
| Action | Extraction of environment variables and an identity token; replay for write access to code, issues, and workflows | assertion | Poisoning Claude Code: One GitHub Issue to Break the Supply Chain (GMO Flatt Security research blog, RyotaK) | high |
| Outcome | State: averted by disclosure. Reported by GMO Flatt Security on 12 January 2026; the permission bypass was fixed four days later, on 16 January 2026, in v1.0.30 (commit 1bbc9e7); all reported issues were fixed as of v1.0.94 (13 April 2026), after several rounds of remediation and follow-up bypasses through spring 2026 (researcher's timeline). Anthropic rated the reported issues, as a set, 7.8 under CVSS version 4.0, a severity score, per the researcher; no public advisory or CVE exists. Separately, in February 2026 a researcher showed that a prompt-injected issue title against a Cline triage workflow built on the same action could expose publish credentials; an unrevoked package-publishing token was later used to push an unauthorized Cline release, presumably by someone reusing the technique. | assertion | anthropics/claude-code-action on GitHub: commit 1bbc9e7, 'fix: add checkHumanActor to agent mode (#826)', 15 January 2026; first released in tag v1.0.30 (16 January 2026); tag v1.0.94 dated 13 April 2026; Adnan Khan: Clinejection — Compromising Cline's Production Releases just by Prompting an Issue Triager; Poisoning Claude Code: One GitHub Issue to Break the Supply Chain (GMO Flatt Security research blog, RyotaK); Claude Code GitHub Action Flaw Let One Malicious Issue Hijack Repositories (The Hacker News, Swati Khandelwal) | medium |
| Evidence: event | Researcher disclosure with a dated timeline; fix in a released version; later press coverage | assertion | anthropics/claude-code-action on GitHub: commit 1bbc9e7, 'fix: add checkHumanActor to agent mode (#826)', 15 January 2026; first released in tag v1.0.30 (16 January 2026); tag v1.0.94 dated 13 April 2026; Poisoning Claude Code: One GitHub Issue to Break the Supply Chain (GMO Flatt Security research blog, RyotaK); Claude Code GitHub Action Flaw Let One Malicious Issue Hijack Repositories (The Hacker News, Swati Khandelwal) | high |
| Recovery: technical | Fix on 16 January 2026 (v1.0.30): agent mode now checks the actor's type and rejects non-human actors unless listed in the action's existing allowed_bots allow-list. Later remediation, complete as of v1.0.94: the workflow run summary disabled by default, a wrapper that blocks exfiltration through the gh command, environment variables scrubbed from child processes, and issues or comments edited after a run is triggered ignored. The researcher recommends auditing workflows for allowed_non_write_users and restricting their permissions and secrets | assertion | anthropics/claude-code-action on GitHub: commit 1bbc9e7, 'fix: add checkHumanActor to agent mode (#826)', 15 January 2026; first released in tag v1.0.30 (16 January 2026); tag v1.0.94 dated 13 April 2026; Poisoning Claude Code: One GitHub Issue to Break the Supply Chain (GMO Flatt Security research blog, RyotaK) | high |
| Recovery: accountability | Coordinated disclosure | assertion | Poisoning Claude Code: One GitHub Issue to Break the Supply Chain (GMO Flatt Security research blog, RyotaK) | high |
Controls
| Status | Control | Canonical |
|---|---|---|
| failed | Process-environment exposure to the agent | C-E1 Least-privilege credential scoped to task |
| failed | In agent mode any GitHub App passed the write-permission check regardless of its actual permissions; the allowed_bots allow-list (in the action since August 2025) and the actor-type check were enforced in tag mode but not in agent mode until the 16 January 2026 fix | C-A1 Actor identity verification |
| succeeded | Coordinated disclosure; Four-day patch | C-O1 Coordinated disclosure program |
| absent | Issue text resembling an error message treated as instruction | C-I1 Retrieved content as data |
Inference
inference Kia's dealer portal let anyone register as a dealer and then granted dealer authority; this action, in agent mode, let any GitHub App, which anyone can create, pass its write-permission check. In both, membership in a class anyone could join was treated as authorization, and nothing checked the actor's actual standing: a real dealership, or write permission on the repository.
Sources
| ID | Record | Type | Link |
|---|---|---|---|
| CLINE | Adnan Khan: Clinejection — Compromising Cline's Production Releases just by Prompting an Issue Triager | researcher primary record | adnanthekhan.com ↗ checked 2026-10-13 |
| FLATT | Poisoning Claude Code: One GitHub Issue to Break the Supply Chain (GMO Flatt Security research blog, RyotaK) | researcher primary record | flatt.tech ↗ checked 2026-10-20 |
| THN | Claude Code GitHub Action Flaw Let One Malicious Issue Hijack Repositories (The Hacker News, Swati Khandelwal) | press pointer secondary: press report | thehackernews.com ↗ checked 2026-10-20 |
| CCA_FIX | anthropics/claude-code-action on GitHub: commit 1bbc9e7, 'fix: add checkHumanActor to agent mode (#826)', 15 January 2026; first released in tag v1.0.30 (16 January 2026); tag v1.0.94 dated 13 April 2026 (interest: vendor's own repository) | company primary record | github.com ↗ checked 2026-10-20 |