Notifications
Clear all
Topic starter
14/08/2026 6:34 pm
TL;DR: GitHub Copilot’s coding agent can research repositories, write code, and open pull requests with developer-equivalent access, and hidden instructions in issues or editor-triggered file reads have already been shown to extract credentials and secrets, according to P0 Security. The core problem is not model quality but the assumption that standing access remains safe when an autonomous tool can act on repository content without human review.
NHIMG editorial — based on content published by P0 Security: When your coding agent can commit everything you can commit
Questions worth separating out
Q: How should security teams govern coding agents that can execute repository instructions?
A: Treat repository instruction files as executable input, not documentation.
Q: Why do AI coding agents complicate secrets management?
A: AI coding agents complicate secrets management because they combine prompting, execution, and environment setup in one workflow.
Q: What breaks when a coding agent has broad write access to a repo?
A: Broad write access lets the agent turn routine output into a persistence or exfiltration channel.
Practitioner guidance
- Scope agent access to task-specific repositories Assign coding agents only the repository and tool permissions needed for the current issue, and remove broad write access where the task can be completed with narrower rights.
- Strip untrusted content before agent ingestion Treat issues, comments, and linked web content as hostile input unless sanitised, and block hidden formatting tricks or remote fetches that can smuggle instructions into the agent.
- Force human review of agent pull requests Require explicit review of every pull request opened by a coding agent, and inspect diffs for embedded secrets, disguised credentials, or changes to workflow files.
What's in the full article
P0 Security's full post covers the operational detail this analysis intentionally leaves for the source:
- Step-by-step examples of how hidden instructions were inserted into GitHub issues and editor-triggered content paths.
- Details on the specific safeguards GitHub says are in place, and where those controls do not apply to agent commit behaviour.
- The researcher and vendor response sequence, including how the issue was reopened and classified as an architectural limitation.
- The second attack path through cloud development environments and file-reading behaviour that widened the impact.
👉 Read P0 Security's analysis of why coding agents inherit developer access →
Coding agents with repo access: are your controls keeping up?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
14/08/2026 6:41 pm
Developer-equivalent access is now a non-human identity problem, not just a software feature problem. Once a coding agent can research a repo, write code, and open pull requests, it inherits the same governance obligations as any other privileged NHI. The article shows that standing access, tool connectivity, and repository write privileges travel together. Practitioners should stop separating agent capability from identity governance.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases.
A question worth separating out:
Q: How do teams know if runtime governance for agents is working?
A: Look for evidence that sensitive actions are being intercepted, evaluated, and either approved, modified, deferred, or denied before execution. You should also see tamper-evident receipts, consistent telemetry into SIEM and SOAR, and a clear reduction in unsafe autonomous actions crossing policy boundaries.
👉 Read our full editorial: Coding agents inherit developer access, and that changes trust
