Claude Code: Indirect Prompt Injection Leading to CI/CD Pipeline Compromise

A critical Indirect Prompt Injection (IPI) vulnerability in Claude Code and integrated AI agent pipelines allows attackers to achieve end-to-end system compromise. By embedding malicious instructions within untrusted external data sources, specifically GitHub Issues, attackers can hijack the execution flow of high-privilege AI agents. Once the agent processes the poisoned input, it leverages its tool-use capabilities—including shell access and API interactions—to execute unauthorized commands. This exploit chain enables the exfiltration of GitHub Action secrets, facilitates sandbox escapes from isolated execution environments, and enables potential Remote Code Execution (RCE) within CI/CD workflows and developer infrastructure, effectively bypassing existing agentic security guardrails.

• Threat Model/Vulnerability Overview
  • Exploitation of Indirect Prompt Injection (IPI) within agentic workflows.
  • Targeting of autonomous agents integrated into trusted CI/CD environments.
  • Abuse of high-privilege tool-use permissions, including shell access and API interaction.
• Attack Mechanics/Exploitation Vector
  • Payload delivery via malicious instructions embedded in GitHub Issues.
  • Hijacking of agent execution flow during the retrieval and processing of external data.
  • Execution of malicious tool-use sequences to target environment variables and secrets.
• Systemic & Security Impact
  • Unauthorized exfiltration of sensitive GitHub Action secrets and authentication tokens.
  • Sandbox escape primitives used to breach isolated execution environments.
  • Potential for RCE on both developer machines and automated build servers.
  • Failure of existing guardrails designed to contain agentic model behavior.
• Countermeasures & Mitigation
  • Application of official Anthropic patches and prompt injection defense documentation.
  • Enforcement of strict least-privilege principles for all AI-driven tool access.
  • Monitoring for hijacked function calls and anomalous CLI log traces within the agent pipeline.