Disclosed vulnerability
Claude Code GitHub Action leaks ANTHROPIC_API_KEY via Read of /proc/self/environ under prompt injection
AIR-2026-0130 AIR record · 2026-06-claude-code-github-action-secret-exposure
From the supporting source
We found that while Claude Code Action supported environment scrubbing for subprocess execution paths such as Bash, the Read tool was not subject to the same sandboxing model. It was eventually authorized to access /proc/self/environ, reading the workflow’s ANTHROPIC_API_KEY and potentially other credentials available to the runner.microsoft.com
The record
Disclosed
2026-06-05
Vendor
Anthropic
Product
Claude Code GitHub Action
Risk domain
Access control and permissions › Credential theft
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — the agent read /proc/self/environ and leaked the API key
Attack surface
Coding agent
Autonomy level
Semi-autonomous
Initial vector
Indirect prompt injection github content
Impact type
Credential theft
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0012 – Valid Accounts
- NIST AI RMF
- MEASURE 2.7
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Use secure credential storage; Implement short-lived tokens.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
CI/CD workflows running Claude Code Action over untrusted issue/PR content
Capability abused
Defense & remediation
Recorded defense
Bubblewrap sandbox + environment scrubbing for Bash; GitHub secret-pattern detection
Guardrail kinds
Sandbox isolation
Guardrail outcome
Silent
Fix shipped
Claude Code 2.1.128 blocks access to sensitive /proc files
Taxonomy & references
Curator notes
Microsoft Threat Intelligence / Defender Security Research Team. Stripping the 'sk-ant-' prefix defeated both Claude's refusal behaviour and GitHub's secret redaction.
Supporting sources
Cite as
Enkrypt AI. "Claude Code GitHub Action leaks ANTHROPIC_API_KEY via Read of /proc/self/environ under prompt injection". AIR, AIR-2026-0130. https://agentincident.vercel.app/i/AIR-2026-0130/ (accessed 2026-10-19).