GitHub issue prompt injection: let AI agents triage issues safely
Anyone can open an issue on a public repository, and issue-triage agents read every word. Aikido's PromptPwnd research showed this path leaking secrets from CI pipelines at Fortune 500 companies.
GitHub
SlackThe workflow
A new GitHub issue arrives. The agent reads it, labels it and drafts a summary for the team channel in Slack.
The attack hidden in it
A hidden comment asks the agent to put the repository secrets and the deploy token in the issue title, where anyone can read them.
How the guardrails handle it
- Screening withholds the hidden comment; the bug report stays.
- The agent never holds a token, so there's no secret it could leak.
- Editing the issue and posting to Slack are writes that wait for approval.
Same workflow, every company size
The agent and the guardrails stay the same; only the systems behind them change.
ServiceNow
Jira Data Center
Azure DevOps
Jira
GitLab
LinearQuestions
What is PromptPwnd?
Aikido's name for prompt injection through GitHub issues and pull requests into AI agents running in CI, which can leak secrets or change workflows.
Can an AI agent leak secrets through a GitHub issue?
Not here: the agent never holds tokens, issue text is screened, and edits need approval.
Does this work with GitLab and Azure DevOps?
Yes, through their native APIs.