Microsoft Researchers Detail Patched Claude Code GitHub Action Flaw That Could Expose Pipeline Credentials

Microsoft researchers disclosed a security flaw in Anthropic’s Claude Code GitHub Action that could have exposed credentials used in software pipelines. According to NS3.AI, Anthropic patched the vulnerability on May 5 after Microsoft reported the issue through HackerOne on April 29. The report said the weakness could have put sensitive credentials at risk within affected development workflows. No additional technical details or impact figures were provided in the update.