Microsoft found a prompt injection flaw in Anthropic's Claude Code GitHub Action that could silently steal your CI/CD secrets — and the same attack class hits Gemini CLI and GitHub Copilot Agent too. Oxford University disclosed its second data breach this term, courtesy of a third-party careers platform used across British universities. CISA added SolarWinds Serv-U to its KEV catalogue. And the window between vulnerability discovery and live exploit has officially collapsed to under one day. Welcome to Tuesday.
☕ ~5 minute read · 5 stories todayMicrosoft's security research team published a detailed account of a vulnerability in Anthropic's Claude Code GitHub Action — the AI coding agent that reviews pull requests, triages issues, and automates CI/CD workflows. The attack is a textbook prompt injection: an attacker posts a hidden instruction inside a GitHub issue or pull request that looks harmless to a human reviewer but is treated as a command by the AI reading it.
The payload Microsoft constructed was elegant in its deception. It instructed Claude to perform a "compliance review" — phrasing chosen specifically to avoid triggering Claude's built-in safety filters. The instruction then directed the model to read /proc/self/environ, which contains all environment variables for the running process, including the ANTHROPIC_API_KEY. To bypass GitHub's secret scanner, the payload told Claude to strip the first seven characters from the key before outputting it. The attacker reconstructs the full key by prepending sk-ant-.
A second, separate research disclosure by security researcher RyotaK found that the Claude Code GitHub Action's permission check unconditionally trusted any GitHub actor whose name ended in [bot] — regardless of actual permissions. Since any GitHub App can open issues on public repositories using only an installation token, an unauthenticated external attacker could chain the bypass with prompt injection to gain write access to any repository using the action. RyotaK says he has reported approximately 50 separate ways to bypass Claude Code's permission system.
claude-code-action v1.0.94 or later and Claude Code 2.1.128 or later. Audit any workflow that allows non-write users or bots to trigger Claude. Strip unnecessary secrets from runner environments. Treat any AI workflow that processes untrusted GitHub content as high-risk by default.
The same prompt injection class affects Google's Gemini CLI Action and GitHub Copilot Agent. This is not a one-vendor problem — it is an architectural problem with AI agents operating inside trust boundaries they were not designed to manage.
The University of Oxford disclosed that its CareerConnect careers platform was breached on 28 May by attackers who exploited a vulnerability in the platform's third-party provider, Group GTI. Exposed data includes first names, last names, email addresses, and encrypted passwords for users who do not sign in via Single Sign-On. The platform is used by students, alumni, research staff, and employers.
GTI says the attack appears aimed at harvesting credentials for future phishing campaigns. The underlying vulnerability has been patched. But the wider exposure is significant: GTI markets the same platform — under the name TargetConnect — to other universities across the UK and internationally, including King's College London and the University of Manchester. The number of affected individuals across all institutions has not been confirmed.
GTI has not disclosed the nature of the vulnerability, the total number of affected individuals, or whether it has notified all institutions using TargetConnect. If you have a CareerConnect account at any UK university, change your password and enable two-factor authentication where available. Be alert to targeted phishing in the coming weeks.
CISA added CVE-2026-28318 to its Known Exploited Vulnerabilities catalogue on 5 June, confirming active exploitation of a denial-of-service vulnerability in SolarWinds Serv-U — a managed file transfer and secure file server platform widely used in enterprise and government environments. Federal civilian agencies must remediate by 19 June 2026.
The flaw is deceptively simple. A remote, unauthenticated attacker sends a specially crafted HTTP POST request using the Content-Encoding: deflate header. Serv-U attempts to process the compressed content, consumes uncontrolled resources, and crashes. No login. No phishing. No social engineering. One malformed request to an internet-facing file server and the service goes down.
content-encoding header at your perimeter.
A report published this week by the Cloud Security Alliance, discussed at DataBreachToday, delivers a finding that security professionals have suspected for some time but that executive leadership has been slow to internalise: the window between vulnerability discovery and weaponised exploit has collapsed from roughly 70 days to under one day.
Troy Leach, Chief Strategy Officer at CSA, stated plainly that the 30-day patch cycle — still standard practice at most organisations — is already obsolete. The maths are unambiguous. If an attacker can build and deploy a working exploit within 24 hours of a CVE being published, a 30-day remediation target means your organisation is exposed for 29 days after the attacker already has a working weapon.
The acceleration is AI-driven. Automated exploit generation tools can take a published CVE, analyse the affected code, and produce a working proof-of-concept in hours. The same tools that defenders use to scan for vulnerabilities are being used offensively to build exploits faster than any human red team could. The three Cisco SD-WAN flaws exploited this week alone demonstrate the pattern in practice.
The Claude Code disclosure is not an isolated incident. It is one data point in a rapidly forming pattern. This year alone: a poisoned VS Code extension breached GitHub's own repositories; malicious npm packages were found designed specifically to harvest credentials from AI coding assistants; and an autonomous bot called HackerBot-Claw spent weeks probing GitHub Actions misconfigurations at Microsoft, Datadog, and CNCF projects, using prompt injection to attempt compromise of AI-based code reviewers.
The structural problem is straightforward. AI coding agents are granted broad permissions — they read code, write files, post comments, trigger workflows, and access secrets — because that breadth is what makes them useful. But that breadth is also what makes them dangerous if an attacker can redirect their actions. The trust model of CI/CD pipelines was designed for deterministic software. AI agents are not deterministic. The same input can produce different outputs. The same safety filter that blocks an obvious malicious instruction on one run might not block a cleverly rephrased version of it on another.
[bot] is the kind of logic flaw that appears obvious in retrospect and invisible in design. It reflects how fast AI tooling is being shipped relative to how carefully it is being threat-modelled. The answer is not to stop using AI coding agents — it is to apply the same adversarial thinking to them that you would apply to any other privileged system in your pipeline.