Claude Code vulnerabilities: CI/CD leak, auto mode bypassed, AWS credential theft

Sep 7, 2026 · Issue 6 · 3 sources, 3 articles

Microsoft has disclosed a Claude Code flaw that could leak CI/CD secrets. Researchers say prompt injection can defeat the safety classifier in Claude Code's auto mode, and CrowdStrike blocked AWS credential theft from a compromised Claude Code agent.

Who is affected and how

senior developer

In workflows that process untrusted content, auto mode should not be trusted with permissions.

Narrative: The coding agent is the new attack surface

Sources

• Microsoft Discloses Claude Code Flaw That Could Leak CI/CD…nowosci.ai · Sep 7, 2026
• When the Safety Classifier Fails: Prompt Injection Defeats Claude Code Auto Mode – Lab Spacelabs.cloudsecurityalliance.org · Sep 8, 2026
• CrowdStrike's Falcon Guardian blocks AWS credential theft from compromised Claude Code agentcryptobriefing.com · Sep 8, 2026

Machine-generated summary based on the titles and excerpts of the source articles. The facts come from the linked article.