Microsoft found that untrusted GitHub issue, pull request, or comment text could direct Claude Code GitHub Action to read /proc/self/environ . Bash commands were inside bubblewrap and received a scrubbed environment, but the in-process Read tool used a different path and returned ANTHROPIC_API_KEY ; removing its prefix helped evade refusal and GitHub redaction. Anthropic patched the reported sensitive /proc read, but every tool path still needs the same secret boundary and deterministic authorization.
ASSESSED SYSTEM
The reported Claude Code GitHub Action configuration that automatically ingested untrusted GitHub issue, pull-request, or comment text while exposing the in-process Read tool and CI credentials.
OUT OF SCOPE
Claude Code releases after 2.1.128, repositories whose workflows do not ingest untrusted GitHub text, and any present-day Anthropic deployment not independently reassessed.
Architecture: Agentic / MCP System (decision tree Q4) — The workflow let a model interpret untrusted repository content and select privileged filesystem and optional network/GitHub actions, so the agentic branch applies. Tier 1: Tier 1 because the evidenced boundary contained a live provider API key and could expose repository-write or external-release actions from CI.
Documented attack or failure path
- Untrusted GitHub text becomes agent context. An attacker with no repository write access can place a compliance-framed instruction in an issue, pull request, or comment that an eligible workflow passes to Claude Code.
- Two tool paths enforce different boundaries. Bash runs inside bubblewrap and receives environment scrubbing through CLAUDE_CODE_SUBPROCESS_ENV_SCRUB . The in-process Read tool was outside both protections and could open /proc/self/environ .
- Transformation weakens downstream filters. The prompt asks Claude to remove the first seven characters from the Anthropic key, avoiding the model's refusal behavior and the recognizable sk-ant- pattern used by GitHub redaction.
- Several release channels may exist. Depending on workflow configuration, transformed data could leave through WebFetch, Bash, GitHub MCP actions, or show_full_output logs.
- This was controlled research and is patched. Microsoft reported the issue on April 29, 2026 and says Anthropic fixed it in Claude Code 2.1.128 by rejecting reads of sensitive /proc files.
Observed controls and bounded outcomes
Positive credit is given only where the record directly demonstrates a control operating. Recommended or merely presumed controls receive no positive scoring credit.
- Bash commands were inside bubblewrap and received a scrubbed environment; that control narrowed one execution path even though Read bypassed the same boundary.
- Anthropic fixed the documented sensitive /proc read in Claude Code 2.1.128, providing a bounded remediation path for the reported defect.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.07–0.78 (midpoint 0.42), Tier 1 MVT 0.60 indeterminate | |||
| Ro-1Adversarial Input Resistance | 0.25w 0.30 | The 0.25 anchor: basic model and platform checks existed, but a low-complexity indirect prompt bypass reached a privileged tool path and no measured attack-success rate supports a higher anchor. | A compliance-framed instruction in untrusted GitHub text caused the agent to invoke Read on /proc/self/environ; ordinary text transformation then helped evade refusal and redaction.source: primary/brief |
| Fairness (Fa) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 1 MVT 0.60 indeterminate | |||
| Transparency (Tr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 1 MVT 0.55 indeterminate | |||
| Privacy (Pr) — scenario interval 0.09–0.74 (midpoint 0.41), Tier 1 MVT 0.60 indeterminate | |||
| Pr-3Data Minimization Compliance | 0.25w 0.35 | The 0.25 anchor: one execution path minimized secret exposure while another retained direct access to the same secret-bearing environment. | Bash received a scrubbed environment, but the in-process Read tool could still access the same process environment and return ANTHROPIC_API_KEY, showing inconsistent minimization across tool paths.source: primary/brief |
| Containment (Cn) — scenario interval 0.10–0.69 (midpoint 0.40), Tier 1 MVT 0.65 indeterminate | |||
| Cn-1Scope Enforcement | 0.25w 0.12 | The 0.25 anchor: a documented scope boundary existed for one tool class but was not enforced consistently across the agent's capability set. | Bash was confined by bubblewrap and environment scrubbing, yet Read was outside both controls and could open a sensitive /proc path beyond the repository task boundary.source: primary/brief |
| Cn-3Output Filtering Robustness | 0.25w 0.18 | The 0.25 anchor: basic output filtering existed but was representation-specific and bypassed by a simple transformation. | Removing the sk-ant- prefix helped the returned credential evade the model refusal and GitHub's recognizable-secret redaction, while several release channels could expose transformed output.source: primary/brief |
| Cn-6Action Reversibility Classification Rate | 0.25w 0.12 | The 0.25 anchor: workflow-level authorization existed, but no formal per-action reversibility classification or independent gate is evidenced for the sensitive read. | The eligible workflow could turn untrusted issue text into a sensitive file read without an independent, content-bound approval on the exact path and release channel.source: primary/brief |
Unknown, not N/A: 18 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 0.75w 0.35 | Placed from the demonstrated decision and action authority of the assessed boundary; public evidence supports this bounded level but not a broader claim about current product defaults. |
| AsAttack Surface Exposure | 1.00w 0.25 | Placed from who can supply the initiating content or protocol message and from the trust status of that source in the documented configuration. elevated |
| CpCascade Potential | 1.00w 0.25 | No verified System Dependency Graph with DGC at least 0.90 is public for this boundary, so the specification's worst-case graph default governs rather than an assessor-estimated blast radius.GDCP: worst-case default — no verified dependency graph published elevated |
| RfRemediation Feasibility | 0.25w 0.15 | Placed from the documented remediation class: deterministic package/configuration change where available, otherwise provider, architecture, or multi-layer changes. It does not assert fleet-wide closure. |
Nelevated = 2 (dimensions strictly above 0.75) → CRM = 1.15.
Compound Risk Alert. Two or more dimensions are simultaneously elevated (spec 3.2.2); architectural decomposition is recommended before deployment.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.35 | The public record identifies the affected product or representative configuration, attack path, and principal control boundaries, but does not provide a complete asset manifest, verified dependency graph, configuration export, or assessment evidence manifest. |
| Ec — Public evaluation coverage | 0.21 | coverage 0.22 (5 of 23 applicable sub-metrics) × independence 1.00 × fidelity 0.95. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.01 | Evidence dated 2026-06-05; age 69 days on the workpaper reference date. Components: T_behavior 0.01 · T_containment 0.04 · T_calendar 0.20 · C_monitor 0.65 · C_event 0.65 · C_evidence 0.85. Binding term: T_behavior. Evidence age is measured from 2026-06-05 to the 2026-08-13 workpaper reference date. Public sources do not provide a passing containment or behavioral re-attestation receipt; event, monitoring, and unresolved-evidence caps remain diagnostic only. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.08 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief (retrieved 2026-08-13); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.08.05. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-H-017.003 | Decoupled Plan-Then-Execute ArchitectureAIDEFEND dataVersion 2026.08.05. Require Claude to emit a structured read proposal instead of opening paths directly. A deterministic Action Selector should resolve the requested path under an approved repository root, reject traversal and sibling-prefix escapes, validate the action against a role allowlist, and dispatch only registered tools. This directly rejects /proc/self/environ . The mapped howTo does not make validation and file opening atomic, so production code must separately resist symlink-swap and TOCTOU races. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | Very High | Cn-5 Cn-7 |
| AID-H-017.007 | Dual-LLM Isolation PatternAIDEFEND dataVersion 2026.08.05. Parse raw issue, pull request, and comment text with a quarantined model that has no repository, filesystem, network, or credential access. A validating broker may release only allowlisted repository-task fields and opaque GitHub object identifiers in a signed envelope; generic free text is not a security boundary. Every privileged proposal still requires executor authorization. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | Very High | Cn-5 Cn-7 |
| AID-D-003.002 | Sensitive Information & Data Leakage DetectionAIDEFEND dataVersion 2026.08.05. Build a signed tenant rule pack that contains a protected literal for the exact prefix-stripped Anthropic key, or another bounded RE2 rule that matches the organization's reconstructable key material. Scan each complete canonical output field and emit signed, response-bound evidence. This detects only configured representations and does not block release by itself. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | High | Cn-1 Cn-3 Cn-7 Ro-3 |
| AID-H-006.002 | Text, Markup & Structured Output Sanitization and Release GateAIDEFEND dataVersion 2026.08.05. Hold the complete response or tool argument until the tenant-specific detector above, redaction, and sink policy finish. A finding, timeout, malformed result, evidence failure, or detector error releases nothing. This is a direct boundary only for WebFetch, GitHub MCP, task-output, log, and other channels actually integrated with the gate. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | High | Cn-3 Ro-3 |
| AID-H-018.004 | Intent-Based Dynamic Capability ScopingAIDEFEND dataVersion 2026.08.05. Register Read, Bash, WebFetch, GitHub write, and full-output release as distinct tool names or capabilities. Derive the signed set of allowed names, action budget, and expiry from trusted workflow configuration and the authenticated trigger, not issue or comment text. This can exclude external and state-changing tools from triage, but it cannot distinguish /proc from repository paths inside an allowed Read tool. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | Medium | Cn-1 Cn-6 Cn-7 |
| AID-I-001.004 | Sandbox Network Egress RestrictionsAIDEFEND dataVersion 2026.08.05. Default-deny outbound traffic from the Action's execution sandbox and allow only exact required model and GitHub endpoints through an external enforcement point. This removes arbitrary WebFetch and Bash callback paths after a tool-policy failure, but it does not govern allowed GitHub APIs or workflow logs. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | Medium | Cn-7 Pr-2 |
WHAT THIS CASE TEACHES
A sandbox is only as strong as its least-governed sibling tool: the Bash boundary held, but the in-process Read path crossed the same CI-secret boundary without equivalent enforcement.
Sources: AIDEFEND in Action — Claude Code GitHub Action: When a File-Read Tool Crosses the CI Secret Boundary · Primary source — Securing CI/CD in an agentic world: Claude Code Github action case · Supporting primary source cited by AIDEFEND