Researcher shows one malicious GitHub issue could hijack repos running Claude Code's GitHub Action

GMO Flatt Security researcher RyotaK found that Claude Code's GitHub Action trusted any GitHub App's installation token as authorized input, letting a crafted issue or pull request bypass write-permission checks and expose the OIDC credentials needed to push code. Reported to Anthropic in January 2026 and fixed within four days, with further hardening through spring; the fix ships in claude-code-action v1.0.94 (CVSS v4.0 7.8).

What it means CI/CD-embedded coding agents inherit the write access of the workflow they run in — treat any agent-triggering input (issue titles, PR bodies, comments) from an untrusted user as untrusted, patched or not.