Claude Code GitHub Action 密钥暴露 (AML.CS0067)

一句话通俗理解

让 Claude 输出 API 密钥还要「去前缀」——GitHub 的密钥扫描器就这么被绕过了。

案例速览

事件经过

微软 Defender 安全研究团队演示了 Anthropic Claude Code GitHub Action 的密钥暴露：经提示词注入诱导 Claude 输出其 API 密钥并去除 sk-ant- 前缀——前缀缺失使 GitHub 的密钥扫描失效，密钥静默泄露；WebFetch、Bash、GitHub MCP 等均可作为渗漏通道。

运用的 ATLAS 技术

以下攻击链映射来自 MITRE ATLAS 官方数据（AML.CS0067 的 employs 关系），按官方步骤编号排序；技术名称链接至本库对应技术文档，引用文字为官方对本次运用的描述。

S00

• 代码仓库 (AML.T0095.000)

  The researchers analyzed the Claude Code Action codebase and the obfuscated Claude Agent SDK. They used the implementation details to understand how agent tools executed and where security boundaries were applied.

S01

• 工具定义 (AML.T0084.001)

  The researchers identified the tools available to Claude Code Action and compared their execution paths. They determined that Bash subprocesses could run within Bubblewrap with a scrubbed environment, while the built-in Read tool performed direct, in-process file access outside that isolation boundary.

S02

• 激活触发器 (AML.T0084.002)

  The researchers identified that Claude Code Action could be triggered by GitHub events involving issues, pull requests, and comments and that the action would fetch the associated content into Claude’s context.

S03

• LLM 提示词构造 (AML.T0065)

  The researchers crafted a prompt tailored to Claude Code Action framed as a compliance task that directed Claude to read a credential from its environment and emit it.

S04

• 通过公开应用进行提示词渗透 (AML.T0093)

  The researchers introduced the malicious prompt through attacker-controlled GitHub content processed by the lab workflow, modeling delivery through an issue body, pull request description, or comment handled by Claude Code Action.

S05

• 间接提示词注入 (AML.T0051.001)

  Claude Code Action incorporated the malicious GitHub content into the model context. Claude interpreted the malicious content as instructions and followed the supplied instructions.

S06

• LLM 越狱 (AML.T0054)

  The prompt used benign compliance review framing and instructions to remove the credential prefix to bypass Claude’s refusal behavior for emitting a recognizable API key.

S07

• AI 智能体工具调用 (AML.T0053)

  Claude invoked its built-in Read tool on /proc/self/environ. Read did not execute within the Bubblewrap and scrubbed-environment boundary applied to Bash subprocesses.

S08

• AI 智能体工具凭证窃取 (AML.T0098)

  The Read tool returned the action process’s unsanitized environment, including ANTHROPIC_API_KEY and potentially other credentials available to the workflow.

S09

• LLM 数据泄露 (AML.T0057)

  Claude emitted the Anthropic API key after removing its sk-ant- prefix. The transformation prevented GitHub’s secret scanner from recognizing the credential, while the researchers could reconstruct the original key by restoring the prefix.

S10

• 通过 AI 智能体工具调用渗漏 (AML.T0086)

  The researchers could use WebFetch, Bash, GitHub MCP, and Action logs as potential exfiltration channels depending on the tools available in the workflow configuration.

关联战术

• 侦察 (AML.TA0002)
• 发现 (AML.TA0008)
• AI 攻击适配 (AML.TA0001)
• 初始访问 (AML.TA0004)
• 执行 (AML.TA0005)
• 权限提升 (AML.TA0012)
• 凭证访问 (AML.TA0013)
• 数据渗漏 (AML.TA0010)

参考资料

以下为 MITRE ATLAS 官方案例收录的参考来源：

• Securing CI/CD in an agentic world: Claude Code Github action case

• MITRE ATLAS 官方案例页 (AML.CS0067)

版本: ATLAS 2026.09 | 更新: 2026-10-24 | 模板: ATLAS 案例研究 v1.0