Two independent Claude Code GitHub Action attacks: issue-triggered repo compromise and API key exfiltration via /proc/self/environ

Adversa AI·high signal

Flatt.tech chained an authorization bypass with indirect prompt injection so that a single public GitHub issue could compromise any repo using the Claude Code GitHub Action workflow. Separately, Microsoft Threat Intelligence disclosed that an unsandboxed Read tool exposed `/proc/self/environ`, letting injected content hidden in untrusted GitHub text exfiltrate `ANTHROPIC_API_KEY`. Both share one root cause worth internalizing: any agent that reads attacker-controlled repo content and holds credentials in its own process environment is one file-read away from key disclosure — put secrets in a broker the agent can call but cannot read, and deny the agent's file tools access to /proc.