Microsoft Discloses Claude Code Prompt-Injection Flaw That Could Leak CI/CD Credentials

Claude Code GitHub Actions allows AI agents to respond to instructions and modify code within software-development workflows. If trigger identities and permissions are not rigorously checked, attackers could use malicious content to induce an agent to access sensitive information such as GitHub tokens. That could compromise code repositories and automated deployment environments, making the patch important for software supply-chain security.

Anthropic patched a permission bypass in Claude Code v1.0.94 caused by insufficient checks on GitHub App triggers. It also strengthened configuration controls and safeguards to reduce the risk of token leaks. Available information did not disclose the exact dates of the vulnerability advisory or patch, the number of affected organizations, any financial losses or known cases of exploitation.

Claude Code is Anthropic’s AI development assistant, with direct access to project files, command execution and development environments. A breach of its trust boundaries could therefore put source code and identity credentials at risk. Cybersecurity company Check Point found vulnerabilities in the tool’s project configuration and sandbox mechanisms, highlighting the supply-chain risks that arise when AI coding tools process external content.

Check Point recently disclosed that attackers could plant a malicious configuration file in a project, triggering remote code execution (RCE) and the theft of API keys when a user opened it with Claude Code. Two other sandbox-escape vulnerabilities had existed for nearly six months. Anthropic has patched the flaws, but researchers criticized the company for not proactively disclosing details. Users were advised to upgrade to version 2.0.65 or later.

Anthropic’s Claude Chrome extension can operate webpages on a user’s behalf, giving it access to tab content and sensitive data. Cybersecurity firm LayerX named the design flaw ClaudeBleed, warning that malicious extensions requiring no special permissions could cross trust boundaries and hijack the AI agent. The flaw highlights the security risks created as browser-based AI tools gain broader privileges.

As of July 20, 2026, Anthropic had released a patched version, but LayerX testing found that version 1.0.70 still did not eliminate the underlying design issue. Attackers could potentially continue using malicious Chrome extensions to control Claude and exfiltrate data. No information has been disclosed about the number of victims, financial losses or the patch’s release date, and users should continue limiting extension permissions and checking installation sources.

Anthropic’s Claude Code is an AI development agent that can read and write code and connect to external tools, while the Model Context Protocol (MCP) links it to data and services. If OAuth tokens are exposed, attackers can assume a developer’s privileges, bypass passwords and multi-factor authentication, and tamper with GitHub repositories. This could turn a compromise of a single device into a software supply-chain attack.

Cybersecurity firm Mitiga disclosed on May 8, 2026, that Claude Code stores MCP configurations and OAuth tokens in plaintext in ~/.claude.json. A malicious NPM package could use a postinstall script to rewrite server addresses and trust flags, redirecting traffic through an attacker-controlled proxy to steal reusable, automatically refreshed tokens. Anthropic said the attack would first require local code-execution access and did not include the issue in its remediation work.

Traditional static analysis relies heavily on existing rules, making it prone to missing contextual vulnerabilities involving business logic or access controls. Anthropic is using Claude to understand entire codebases in an effort to embed security reviews into development workflows. If companies cut spending on existing tools, the valuations of platform providers such as CrowdStrike and Palo Alto Networks, as well as financial institutions' procurement decisions, could be affected.

Anthropic launched a limited research preview of Claude Code Security for enterprise customers on February 20, 2026. Pricing was not disclosed, while open-source maintainers can apply for free access. Claude Opus 4.6 has identified more than 500 vulnerabilities. On February 23, CrowdStrike, Datadog and Zscaler fell about 11%, Fortinet and Okta dropped about 6%, and Palo Alto Networks declined 3%.

AI agents can autonomously read email, call tools and execute workflows, meaning a prompt-injection attack could cause more than an incorrect response and potentially spread into corporate systems. Researchers identified Anthropic’s Claude, Google’s Gemini and Microsoft’s Copilot, showing that all three platforms face cybersecurity challenges stemming from insufficient controls over agent permissions and data isolation.

As of July 20, 2026, the latest disclosures indicated that attackers could hide malicious instructions in content read by AI agents, tricking them into exposing API keys and other sensitive data. Experts recommend that companies manage AI agents like employee accounts, applying least-privilege access, tiered authorization and continuous monitoring. Reports have not disclosed any financial losses or the number of victims.

The cybersecurity industry has long relied on rules-based static analysis and manual reviews. Static tools struggle to detect contextual vulnerabilities involving business logic and access controls, while manual reviews are constrained by the supply of skilled professionals. Anthropic’s use of large language models to find vulnerabilities and draft patches could shift defenses from post-incident detection to the development stage. It is also prompting investors to reassess the pricing power and competitive barriers of traditional cybersecurity software.

Anthropic released a research preview of Claude Code Security on February 20, 2026. The tool can scan for vulnerabilities and propose patches that require human approval. On February 23, CrowdStrike, Datadog and Zscaler fell about 11%, while Fortinet and Okta dropped about 6%. CrowdStrike had lost 18% since the product’s release, wiping about $20 billion from its market value.

OpenAI Codex can connect to GitHub repositories, read code and perform tasks on developers’ behalf, giving it access to privileged tokens. BeyondTrust said attackers could exploit prompt injection to turn the development workflow into a channel for leaking credentials if untrusted repository data is not properly isolated.

BeyondTrust researchers disclosed that attackers could hide malicious instructions in GitHub branch names, prompting Codex to execute commands and steal users’ GitHub access tokens. The affected scope included the Codex integration in ChatGPT’s web version and related SDKs. OpenAI completed a fix in February 2026 after receiving the report.

Anthropic’s Claude Chrome extension can read webpage content and help perform browser tasks, but that capability also creates a risk that the AI may mistake text from an untrusted website for instructions. Cybersecurity firm Koi Security named this type of zero-click prompt-injection technique ShadowPrompt, highlighting a new security risk facing AI assistants with agentic capabilities.

Koi Security recently disclosed that attackers could embed hidden prompts in malicious websites, allowing Claude to be covertly manipulated and diverted from its intended task without the user clicking or entering anything. Anthropic patched the vulnerability by the end of 2025. Public reports have not specified the exact patch date, the number of victims or any related financial losses.

Traditional static analysis relies heavily on established rules and can miss flaws involving data flows across components, business logic and access controls. Security teams also struggle to process large vulnerability backlogs. Anthropic has therefore integrated Claude’s code-reasoning capabilities into defensive workflows, enabling AI to scan and validate code and propose patches, though developers must still approve any fixes.

Anthropic launched the Claude Code Security research preview on February 20, 2026. Powered by Claude Opus 4.6, it scans and validates code and proposes patches, and has identified more than 500 vulnerabilities in open-source projects. The company released a six-stage reference workflow on May 27. As of May 22, it had disclosed 1,596 vulnerabilities, 97 of which had been fixed.