Securing CI/CD in an agentic world: Claude Code Github action case

Microsoft Threat Intelligence disclosed a security finding and ecosystem updates focused on risks to developer and CI/CD environments. Key items: a prompt‑injection pathway in the Claude Code GitHub Action that — under specific conditions — could expose workflow secrets (responsible disclosure to Anthropic and mitigations detailed); an updated taxonomy of seven new failure modes for agentic AI based on a year of red teaming; multiple large supply‑chain and credential‑theft campaigns targeting npm (including the Red Hat “Miasma” campaign, dependency‑confusion and typosquatting operations) that盗