A security researcher reports a flaw in Anthropic’s “Claude Code” GitHub Action that could allow an attacker to take over repositories that run the action. The researcher says the attack can begin with only a single GitHub issue opened by a malicious actor. The issue is described as appearing like an error message and is crafted so that, when the Claude Code action processes the issue for triage, it can follow instructions embedded in the issue content.
According to the reports, the action could expose information available to the workflow and enable an attacker to use that access to hijack the repository context. The researcher also highlights a potential amplification: Anthropic’s own action repository uses the same workflow. In that scenario, a successful attack could enable malicious changes to propagate into the action itself, which could then affect other projects that depend on the action downstream.
The outlets describe the issue-handling and workflow behavior that underpins the risk, emphasizing that the starting point is an attacker-controlled issue rather than more complex intrusion methods.
