Anthropic Claude outage disrupted users as GitHub Actions flaw exposed repository risk

Anthropic’s Claude platform suffered a widespread service disruption that affected users globally across the web app, mobile clients, and Claude Code, with reports of elevated errors, long response delays, hung sessions, and failed requests involving models such as Opus 4.6 and Sonnet 4.6. User complaints rose sharply after the incident began around 0600 UTC, and Anthropic’s status page moved from reporting a partial outage to saying a fix had been implemented before later marking systems operational, though some customers continued to report intermittent problems after remediation.

Separately, a security researcher disclosed a critical supply-chain vulnerability in Anthropic’s official Claude Code GitHub Actions workflow that could have allowed an unauthenticated attacker to compromise repositories using it, including Anthropic’s own. The flaw stemmed from write-permission checks that trusted any GitHub actor whose name ended with [bot], enabling a malicious GitHub App bot to bypass restrictions and, when chained with prompt injection, potentially exfiltrate secrets, steal GitHub Actions OIDC credentials, obtain a privileged Claude GitHub App token, and push malicious code downstream; Anthropic said it patched the issues in v1.0.94 with stronger actor validation and additional workflow hardening.