A single crafted GitHub issue was all it took to potentially turn Anthropic's Claude Code GitHub Action into a credential-leaking tool.
Claude Code's GitHub Action is built to automatically triage issues in repositories that deploy it. A security researcher found that an attacker could open an issue whose body appeared to be a routine error message but contained embedded instructions. When the action picked up that issue for triage, it followed the hidden instructions, read the process's environment variables, and wrote them back out. No exploit code, no sophisticated access required - just carefully worded text posted by a bot account.
The exposure was broad by design. GitHub Actions runners routinely carry API keys, deploy tokens, and repository-scoped credentials. Any project that had installed the Claude Code GitHub Action was potentially in scope - meaning the action's own adoption became the attack surface. That is a textbook supply chain risk: the more popular the tool, the wider the blast radius.
Prompt injection - embedding instructions inside content an AI system is expected to read and act on - is one of the oldest and most documented failure modes for agentic AI. It predates the current wave of coding assistants by years. What makes this case worth noting is not that the flaw existed, but that it surfaced in tooling built by a lab that markets its safety expertise as a selling point. Finding it apparently required an outside researcher, not an internal red team.