GitHub warns its new agent approval flow is not a security control: why it is not safe to use

What happened

On July 23, 2026, GitHub announced new automation controls for GitHub Issues in public preview. These controls work with GitHub Agentic Workflows and Copilot cloud agent automations. For actions such as adding labels, assigning people, changing fields, and closing issues, GitHub can now show an approval step, a confidence score, and a short rationale.

GitHub also makes an important point in its announcement: approvals are "a workflow convenience, not a security control." In plain terms, that means the visible review step is meant to help teams manage work, not to act as a hard safety boundary. GitHub says that if an agent already has permission to change issues, it can make those changes directly instead of sending them for approval.

What it means for you

If you use an AI agent, do not assume an approval screen means the agent is safely contained. It may look reassuring, but it does not replace real permissions. Permissions are the rules that decide what a tool is allowed to do.

This matters most for non-technical users, because approval buttons can feel like protection when they may only be part of the workflow.

What to do instead

Keep agent permissions as narrow as possible. Only give issue-changing access to tools that truly need it. Check who can install or connect automations. Review what actions an agent can take before turning it on. Treat confidence scores and rationales as helpful hints, not guarantees.

If you use skill libraries, prefer reviewed options. AgentPod lists only reviewed, tested skills, which can help reduce surprises, but it is still important to check permissions and settings yourself.

Sources:

• https://github.blog/changelog/2026-07-23-agent-automation-controls-in-github-issues-in-public-preview/