Prompt Injection via Issues

What Is Prompt Injection via Issues?

An automated triage bot reads new issues and opens pull requests. A bug report hides an instruction, and because the bot has write access and sits in the auto-merge allowlist, that instruction becomes a merged workflow that posts a secret to an outside host. You'll trace the pull request back to the issue the bot obeyed, make the bot's token read-only, take it off auto-merge, require review on any change to CI, and rotate the leaked token. The lesson: bound the agent's token, not its prose.

What You'll Learn in Prompt Injection via Issues

• Explain how an autonomous agent with repository write turns untrusted input, like a public issue, into merged, running code
• Recognise why pull_request_target runs with the base repository's secrets and why a bot-authored workflow using it is dangerous
• Trace a leaked secret from the workflow run back through the pull request to the issue that drove it, using the flight recorder
• Bound the agent instead of the prose: scope its token to read-only, remove it from auto-merge, and require review on changes under .github/workflows
• Contain a leaked credential by rotating it, and prove both the guardrail and the rotation by replay

Prompt Injection via Issues — Training Steps

1. A bug report with a hidden ask

   Bob needs no account at Crowvale to reach its automation. He files a public bug report on the checkout-api repository. The top reads like an ordinary timeout bug. Buried in an environment-details block is an instruction, not for a person, but for the triage bot that reads every new issue before anyone does.

2. The token lands

   Overnight the triage bot read the issue, opened a draft pull request adding the workflow, and auto-merge took it in. The first time the workflow ran, it did exactly what the issue told it to. Bob checks his collector.

3. Deploy as Crowvale

   A deploy token is a key to production. Bob points the API Tester at Crowvale's deploy service and carries the stolen token in an Authorization header.

4. An overnight deploy nobody ran

   First thing this morning, your security lead Soraya has filed an issue in Jotvane, the team tracker. A workflow run overnight posted one of the repository's secrets to a host outside Crowvale, and a production deployment followed that nobody on the team started.

5. The pull request the bot merged

   You never wrote this change. Open the pull request Soraya linked and see what it added and how it reached the default branch.

6. What the run did

   A merged workflow runs. Open the actions log and read the run that fired when the bot's pull request landed.

7. Replay the bot's session

   Crowvale's triage bot runs on the same assistant, and its session is recorded. The workflow file it wrote is open, and the bot's run on issue #217 is loaded: what it read, the steps it took, the lines it wrote.

8. Issue in, workflow out

   The recorder shows the hop. The bot fetched a new issue, then edited a workflow file. A new issue is untrusted input: anyone on the internet can file one. Find the edit on the recorder where the workflow file was written.

9. The hidden instruction

   Go back to the issue the bot read and find the line it obeyed.

10. Why it could do this