Agent-on-agent prompt injection in public GitHub workflows was shown to trigger a privileged maintainer agent: why it is not safe to use

What happened

On August 3, 2026, The Register reported research from Pillar Security about a weakness in some GitHub automation setups. The researchers said a public-facing, low-privilege agent in a repository could be manipulated with prompt injection, which means hidden instructions placed in text that an AI system reads and follows. In the reported example, the attack used two pull requests, or proposed code changes. The first looked harmless and helped build trust. The second carried the injected instructions. That led a separate maintainer-only agent, one meant for more trusted actions, to run a malicious step through the workflow.

The key point was not a bug in one message alone. The researchers said the risk appears when two automated agents share a trust boundary, meaning one agent can influence another in ways maintainers may not notice.

What it means for you

If you use Claude Code, Codex, or similar tools, this is a reminder that reading untrusted repository text can turn into action when agents are connected to automated workflows. A comment, issue, or pull request may be more than just text if your setup lets one agent hand work to another with higher privileges.

What to do instead

Treat public repo content as untrusted input. Keep review-only agents separate from agents that can merge, deploy, or change settings. Require an explicit human check before any high-privilege action. Limit what each agent can access and do. Be careful about workflows where one agent can trigger another. Use trusted, reviewed tools and skills. AgentPod lists only reviewed, tested skills, which can help reduce avoidable workflow risk, but it is still important to keep permissions narrow and approvals clear.

Sources:

• https://www.theregister.com/security/2026/08/03/google-dev-kit-spurs-first-ever-agent-on-agent-violence/