Claude Code GitHub Action Flaw Let One Malicious Issue Hijack Repositories

Source summary: A security researcher found a flaw in Anthropic's Claude Code GitHub Action that let an attacker take over vulnerable public repositories running it, with nothing more than a single opened GitHub issue. Because Anthropic's own action repo used the same workflow, a working attack could have pushed malicious code into the action itself and onto the projects downstream that pull it. RyotaK of GMO

Why it matters: Add your own practical explanation here before publishing.

What to do: Add recommended action/checks here.

Read the original source

Original source: The Hacker News