Research Finds Permission Bypasses and Secret-Exposure Risks in AI-Powered GitHub Actions
Summary
Wiz researchers found permission-check bypasses and prompt-injection paths to expose local credentials in AI-powered GitHub Actions. OpenAI changed bot controls, Anthropic updated its documentation, and Wiz reported vulnerable workflows to maintainers.
Key points
- Researchers found that bot checks in OpenAI's Codex Action and Anthropic's Claude Code Action could trust external bots based on bot status or name, enabling workflow gates to be bypassed.
- Dependabot deputy confusion can make an attacker-triggered workflow appear to have been invoked by Dependabot, bypassing bot allowlists.
- Prompt injection can lead AI actions to read dynamically created credential files, including cloud credentials, SSH keys, and container registry tokens.
- Verbose workflow logging can expose file contents, including credentials, even when an AI model recognizes them as sensitive.
- Several reviewed actions lack built-in permission checks, and workflows can expose AI actions to untrusted issue, comment, or pull-request inputs.
- The researchers recommend restricting who can trigger actions, limiting tool permissions, avoiding risky bot settings and verbose logs, and not combining AI actions with workflows that create sensitive local credentials.
- OpenAI introduced more granular bot controls and removed Dependabot from the trusted zone; Anthropic updated its documentation, and Wiz reported vulnerable workflows to project maintainers.
Article Details
- Attack Vectors
- External GitHub Apps or bots can bypass relaxed bot-allowance checks in openai/codex-action and anthropics/claude-code-action because the checks rely on bot status or name rather than verifying the App's authorization for the repository.
- An attacker can exploit name-based trust by creating a GitHub App with the same available name as an allowed bot.
- Dependabot Deputy Confusion Injection can make Dependabot appear as the author of a pull request or issue, bypassing actor-based workflow checks. The article describes triggering this with @dependabot recreate or @dependabot show, depending on the event.
- Attacker-controlled pull request titles, issue bodies, and comments can be interpolated into AI prompts, enabling prompt injection when the action has access to tools or sensitive data.
- Prompt injection can cause an AI action to read dynamically created local credential files and expose their contents in workflow logs; verbosity settings can also reveal file-reading output.
- Defensive Notes
- Do not rely on models to prevent prompt injection; restrict who can control action inputs and limit the action's permissions and tool access.
- Avoid insecure allow-bots and allowed_bots settings in anthropics/claude-code-action and openai/codex-action.
- For actions without built-in access checks, add author-association checks to comment-triggered workflows and use secure permission defaults.
- Avoid combining an AI action with broad access and authentication actions that create sensitive local credential files in the same workflow.
- Avoid verbosity modes in public repositories, including show_full_output and gemini_debug.
- Action authors should document which actors can trigger an action and warn about dangerous configurations.
Vendors
AnthropicAI-powered GitHub Actions from vendors like OpenAI, Anthropic, and Google are now running in thousands of public workflows. We set out to map the shared responsibility model for these actions and we found:GoogleAI-powered GitHub Actions from vendors like OpenAI, Anthropic, and Google are now running in thousands of public workflows. We set out to map the shared responsibility model for these actions and we found:OpenAIAI-powered GitHub Actions from vendors like OpenAI, Anthropic, and Google are now running in thousands of public workflows. We set out to map the shared responsibility model for these actions and we found:WizWiz customers: use the rich set of CCRs and Controls that forms the CICD Security category of "Wiz for Code and Supply Chain Security Framework":
Products
actions/ai-inferenceactions/ai-inferenceanthropics/claude-code-actionanthropics/claude-code-action (used in over 12K public workflows)anthropics/claude-code-security-reviewanthropics/claude-code-security-reviewClaude Codeinjection is an inherent challenge for all LLM-based systems. This risk is not theoretical - multiple Claude Code CVEs explicitly note that "reliably exploiting this requires the ability to add untrusted content intocoderabbitai/ai-pr-reviewercoderabbitai/ai-pr-reviewerDependabotHowever, a more prevalent setting is granting dependabot access to claude-code-action (a quick search shows multiple workflows across popular projects with over 1K stars).Geminigoogle-github-actions/run-gemini-cli (used in over 1K public workflows)GitHub ActionsAI-powered GitHub Actions from vendors like OpenAI, Anthropic, and Google are now running in thousands of public workflows. We set out to map the shared responsibility model for these actions and we found:google-github-actions/run-gemini-cligoogle-github-actions/run-gemini-cli (used in over 1K public workflows)openai/codex-actionopenai/codex-actionqodo-ai/pr-agentqodo-ai/pr-agentVertex AIBecause the workflow authenticates via GCP Vertex AI rather than Gemini API key, it has to rely on a previous google-github-actions/auth@v2 action that creates a local JSON file with GCP service account credentials.