A GitHub issue can become a write-capable path into a repo when a CI action trusts the wrong thing. The broken assumption is that a name ending in [bot] means safe, and that issue text is only input, not something that can steer a workflow into exposing secrets or changing code.
Anthropic fixed the flaw in Claude Code GitHub Action in v1.0.94 after researcher disclosure. The action’s trigger check accepted any actor ending in [bot], which let a malicious GitHub App open an issue on a public repo and feed attacker-controlled text into a workflow that had broad read-write permissions.
In Anthropic’s own action repo, that same trust gap could have reached downstream consumers of the action. For teams running Claude Code GitHub Action in GitHub Actions, the risk is not just a bad suggestion from an AI assistant; it is attacker-controlled issue text turning into repository access and supply-chain impact.