A malicious GitHub App could trigger Anthropic’s Claude Code Action, exploit a prompt injection through a crafted issue, steal workflow credentials, obtain an OIDC token, and push malicious code to the action’s own source repository. The bypass was one function: checkWritePermissions unconditionally trusted any actor whose identity ended in [bot]. Policy-as-code on CI/CD closes the confused-deputy path even when the agent is the deputy.