Synthetic Industry

Troubleshooting guide · updated 2026-10-12

Issue and pull request text can steer an AI agent in GitHub Actions: how to limit what it can do

What researchers have shown, what GitHub does for its own agent, and four controls you can apply: a read-only job, minimum token, checked outputs and a bot account with the least role.

What researchers have shown

Aikido reported that issue titles and bodies, pull request descriptions and commit messages placed in an AI agent's prompt can leak tokens and keys. The confirmed case was Google's Gemini CLI, which Google fixed; other agents were exposed under certain settings.

The agent was doing its job, and the text it read contained instructions.

What GitHub does for its own agent

GitHub's agent can push to a single branch only, and its workflows wait for a person with write access to approve them. The person who asked for a pull request cannot approve it, and hidden characters such as text in an HTML comment are filtered out.

Four controls you can copy

Make the reading job read-only with no secrets except a restricted model key with a spend cap and a minimal-permission workflow token, and give the token the minimum permissions. Let a second job apply only checked outputs, such as a label from a fixed list, and give any bot account the least role that works.

GitHub's triage example does the first three. Its agent holds only contents: read and issues: read, and writes go through safe outputs.

  • Read-only agent job, only a restricted model key
  • Minimum GITHUB_TOKEN permissions
  • Writes only through checked outputs
  • Least-role bot account

What the roles allow

The Read role can submit reviews on pull requests but cannot apply labels. The Triage role can apply labels, close and assign, but cannot push or merge. Neither role can approve where reviews are required.

What none of this proves

A tested control limits the damage if the agent is tricked. It does not stop the trick. Treat a passed test as a baseline, not as immunity, and repeat it when workflows change.

Sources and limits

  • Aikido: PromptPwnd Checked 2026-10-12.
    • Issue titles and bodies, pull request descriptions and commit messages placed in prompts of AI agents in GitHub workflows can leak tokens and keys.
    • The confirmed case was Google's Gemini CLI, which Google fixed; other agents were exposed under certain settings. Published 4 December 2025, updated 17 March 2026.
  • GitHub: risks and mitigations of the Copilot coding agent Checked 2026-10-12.
    • GitHub's own agent can push to a single branch only, and its workflows do not run until someone with write access approves them.
    • GitHub prevents the person who asked the agent to open a pull request from approving it.
    • GitHub filters hidden characters, such as text in an HTML comment, before passing user input to the agent.
  • GitHub: security hardening for GitHub Actions Checked 2026-10-12.
    • GitHub recommends pinning actions to a commit SHA when a lockfile is not possible.
    • The GITHUB_TOKEN should be granted the minimum required permissions, with more given to individual jobs only as needed.
    • Untrusted input such as a pull request title should go through an intermediate environment variable, not straight into a script.
  • GitHub: repository roles for an organization Checked 2026-10-12.
    • The Read role can submit reviews on pull requests but cannot apply labels or approve or request changes where reviews are required.
    • The Triage role can apply labels, close and assign issues and pull requests and mark duplicates, but cannot push or merge.
  • GitHub Agentic Workflows: AI issue triage example Checked 2026-10-12.
    • The example agent holds only contents: read and issues: read, and writes go through safe outputs that check label names and comment content first.
    • The page warns that labels can trigger other automation.