{
 "public_id": "AIR-2026-0130",
 "incident_id": "2026-06-claude-code-github-action-secret-exposure",
 "date_disclosed": "2026-06-05",
 "date_occurred": null,
 "title": "Claude Code GitHub Action leaks ANTHROPIC_API_KEY via Read of /proc/self/environ under prompt injection",
 "class": "responsible_disclosure",
 "attack_surface": "coding_agent",
 "initial_vector": "indirect_prompt_injection_github_content",
 "agent_capability_abused": [
  "file_read_tool",
  "ci_environment_access"
 ],
 "target_product": "Claude Code GitHub Action",
 "target_vendor": "Anthropic",
 "autonomy_level": "semi_autonomous",
 "impact_realized": false,
 "impact_type": [
  "credential_theft"
 ],
 "blast_radius": "CI/CD workflows running Claude Code Action over untrusted issue/PR content",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI01",
   "ASI03"
  ],
  "mitre_atlas": [
   "AML.CS0067"
  ],
  "labels": [
   "ci_cd_agent",
   "sandbox_gap",
   "secret_scanner_bypass",
   "proc_self_environ"
  ]
 },
 "defense_present": "Bubblewrap sandbox + environment scrubbing for Bash; GitHub secret-pattern detection",
 "defense_bypassed": true,
 "fix_shipped": "Claude Code 2.1.128 blocks access to sensitive /proc files",
 "primary_sources": [
  "https://www.microsoft.com/en-us/security/blog/2026/06/05/securing-ci-cd-in-agentic-world-claude-code-github-action-case/",
  "https://raw.githubusercontent.com/mitre-atlas/atlas-data/main/dist/v6/ATLAS-2026.07.yaml"
 ],
 "verified_quote": "We found that while Claude Code Action supported environment scrubbing for subprocess execution paths such as Bash, the Read tool was not subject to the same sandboxing model.  It was eventually authorized to access /proc/self/environ, reading the workflow’s ANTHROPIC_API_KEY and potentially other credentials available to the runner.",
 "confidence": "high",
 "notes": "Microsoft Threat Intelligence / Defender Security Research Team. Stripping the 'sk-ant-' prefix defeated both Claude's refusal behaviour and GitHub's secret redaction.",
 "risk_category": "security_fraud",
 "risk_secondary": [],
 "risk_subcategory": "Prompt Injection",
 "risk_sub_secondary": [
  "Credential & Secret Theft"
 ],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "the agent read /proc/self/environ and leaked the API key",
 "vector_family": "indirect_prompt_injection",
 "vector_detail": "indirect_prompt_injection_github_content",
 "guardrail_kind": [
  "sandbox_isolation"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [
   "AML.CS0067"
  ],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI01",
 "agent_framework": "claude_code",
 "model_provider": "anthropic",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "credential_theft",
 "eai_domain": "access_control_and_permissions",
 "eai_secondary": [
  "confused_deputy"
 ],
 "eai_reason": "impact rule: credential_theft",
 "asi_curated": [
  "ASI01"
 ],
 "asi_scope": "in_scope",
 "asi_provenance": "curated_plus_rule",
 "asi_reason": "curated: ASI01 | added ASI03 (eai_category=credential_theft)",
 "submitted_by": "EAI Internal"
}