Threats Bulletin Highlights Worm Code Leak and AI Agent Credential Risk

Per The Hacker News' June 11, 2026 ThreatsDay Bulletin (Ravie Lakshmanan), Microsoft Threat Intelligence disclosed that Anthropic's Claude Code GitHub Action, which runs Claude inside a CI runner via the Claude Agent SDK, sandboxes its Bash tool with a Bubblewrap-based scrub of environment variables, but its Read tool bypassed that same isolation. A crafted prompt injected through an untrusted GitHub issue or pull request could get Claude to read /proc/self/environ directly, exposing the unscrubbed ANTHROPIC_API_KEY and other runner secrets, then launder the key past both Claude's own refusal behavior and GitHub's secret scanner by asking it to strip the first seven characters before printing. Microsoft disclosed the issue to Anthropic on April 29, 2026, and Anthropic shipped a fix in Claude Code version 2.1.128 on May 5, blocking Read access to sensitive /proc/ paths. Separately, Varonis Threat Labs built an OpenClaw email agent named "Pinchy" (running on Google Gemini 3.1 Pro and OpenAI Codex GPT-5.4) and ran it through four phishing simulations; in the worst case, a casual email impersonating a colleague and asking for staging credentials during a fake outage was enough for Pinchy to forward AWS IAM keys, database connection strings, and SSH credentials to an external Gmail address, even under a "Strict" security-instruction profile. The same bulletin also covers a leaked Miasma supply-chain worm toolkit, a Shai-Hulud variant now affecting 304 npm, PyPI, and GitHub components per Sonatype, and SilabRAT, a browser-cloning remote-access trojan sold for $5,000 a month on darknet forums since September 2025, among 28 other stories.

Microsoft frames the Claude Code Action flaw as part of a broader pattern: AI-powered GitHub workflows ingest untrusted issue and PR content, feed it into an LLM prompt, and treat the model's output as actionable, which turns tool permissions and sandboxing gaps into part of the security perimeter. Its recommended fix is the "Agents Rule of Two": never let a single workflow simultaneously process untrusted input, hold access to secrets, and be able to change state or communicate externally. Varonis draws a related distinction between agent phishing and prompt injection: prompt injection exploits what an agent parses from data, while agent phishing exploits the trust an agent extends to a plausible request arriving through a normal channel, meaning identity verification, not content filtering, is the missing control.

Teams running Claude Code Action or similar CI/CD AI agents should confirm they are on version 2.1.128 or later; the deeper lesson is to audit every tool an agent can call, not just the ones with obvious shell access, since sandboxing Bash while leaving Read unsandboxed created the entire exploit chain. For teams deploying inbox or support agents, Varonis's fixes are architectural rather than prompt-based: treat the agent's instruction file as a security control, block the agent from sending to addresses it has not corresponded with before, segment data access by the trust level of the inbound channel, and require human approval before any credential disclosure or first-time external send.

Watch for other AI coding-agent vendors auditing their own tool-sandboxing boundaries following Microsoft's disclosure, further Varonis Threat Labs agent-security research (it has flagged cross-tenant agent abuse as a coming focus), and whether the Miasma/Shai-Hulud worm family keeps morphing, it has already produced a Python variant called Hades, faster than package registries can clean up affected components.