Comment by detente18

From our investigation, the token compromised was included by claude code in the tool call.

This was captured in the request/response logs.

The attacker, having gotten access to the logs, then looked for this and used it.

So - yes a local github cli oauth token, but not the machine.