@GMO Flatt Security

Security researchers at Flatt.tech disclosed a critical supply-chain vulnerability in Anthropic's Claude Code GitHub Actions integration that a single malicious GitHub issue, pull request, or comment …

A flaw in Anthropic's Claude Code GitHub Action allowed attackers to bypass permission checks via a fake bot account and use prompt injection to steal OIDC tokens, gaining write access to any vulnerab…