GitHub Agentic Workflows Data Leak: Hardening and Detection Guide

---
title: Potential Data Leak via Agentic Workflow on Public Issue
id: 8a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects when a known Agentic Workflow (e.g., Copilot) comments on a public issue. The comment body should be inspected for potential leakage of private internal paths or secrets.
references:
  - https://thehackernews.com/2026/07/public-github-issue-could-trick-github.html
author: Security Arsenal
date: 2026/07/10
tags:
  - attack.exfiltration
  - attack.t1567.001
logsource:
  product: github
  service: audit
detection:
  selection_event:
    action:
      - issue_comment.created
      - issue_comment.edited
  selection_public:
    repository_public: true
  selection_actor:
    actor|contains:
      - 'github-actions[bot]'
      - 'copilot'
      - 'agent'
  # Keyword heuristics to identify potential private data in the output
  selection_keywords:
    comment_body|contains:
      - 'API_KEY'
      - 'PRIVATE_KEY'
      - 'internal'
      - '.env'
      - 'config/production'
condition: selection_event and selection_public and selection_actor and selection_keywords
falsepositives:
  - Legitimate support bot addressing a public bug report referencing internal docs.
level: high
---
title: Agentic Workflow Read Access to Private Repo Post Public Trigger
did: 9d3c4e5f-6a7b-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
description: Detects a workflow run or heavy read access on a private repository immediately following an issue creation on a public repository by a low-reputation user.
references:
  - https://thehackernews.com/2026/07/public-github-issue-could-trick-github.html
author: Security Arsenal
date: 2026/07/10
tags:
  - attack.collection
  - attack.t1005
logsource:
  product: github
  service: audit
detection:
  selection_issue:
    action: issue.created
    repository_public: true
  selection_read:
    action|contains:
      - 'git.clone'
      - 'repository.read'
    repository_public: false
  filter_benign:
    actor_login|endswith: '[bot]' # We focus on bot accounts doing the reading
  timeframe: 5m
condition: selection_issue and selection_read and filter_benign | timeframe()
falsepositives:
  - Automation updating documentation across public/private repos.
level: medium

// Hunt for Agentic Workflows commenting on public issues with indicators of private data
GitHubAuditLog
| where Action == "issue_comment.created"
| extend IsPublic = todynamic(Repository)["public"]
| where IsPublic == true
| extend Actor = ActorLogin
| where Actor contains "bot" or Actor contains "agent" or Actor contains "copilot"
| extend CommentBody = coalesce(todynamic(tostring(Comment))["body"], tostring(CommentBody))
| where CommentBody matches regex @"(private|secret|password|token|api_key|internal_config)"
| project TimeGenerated, Actor, RepositoryName, IssueNumber, CommentBody
| order by TimeGenerated desc

-- Hunt for GitHub CLI or Agent configurations on endpoints that might have over-privileged scopes
SELECT FullPath, Size, Mtime, Data
FROM glob(globs='/Users/*/.config/gh/**', '/root/.config/gh/**', '/home/*/.config/gh/**')
WHERE Data =~ 'oauth_token' 
   OR Data =~ 'workflow_scope'
   OR Data =~ 'read:org'
-- Check for local agent cache that might contain leaked context

#!/bin/bash
# Remediation: Audit and Report GitHub Workflow Permissions
# Usage: ./audit_workflow_perms.sh ORG_NAME

ORG_NAME=$1

if [ -z "$ORG_NAME" ]; then
  echo "Usage: $0 ORG_NAME"
  exit 1
fi

echo "[+] Auditing repositories in $ORG_NAME for default workflow permissions..."

# Get list of repos
REPOS=$(gh repo list "$ORG_NAME" --limit 400 -- name --jq '.[].name')

for repo in $REPOS; do
  echo "[+] Checking: $repo"
  
  # Check default workflow permissions at the org level is harder via CLI, 
  # so we inspect specific workflow files for 'permissions' block.
  
  # List workflows
  WORKFLOWS=$(gh api repos/$ORG_NAME/$repo/actions/workflows --jq '.workflows[].path' 2>/dev/null)
  
  if [ -z "$WORKFLOWS" ]; then
    continue
  fi

  for wf in $WORKFLOWS; do
    # Download workflow content
    CONTENT=$(gh api repos/$ORG_NAME/$repo/contents/$wf --jq '.content' 2>/dev/null)
    
    if [ ! -z "$CONTENT" ]; then
      DECODED=$(echo "$CONTENT" | base64 -d)
      
      # Check for 'contents: write' or missing permissions (implies default write)
      if echo "$DECODED" | grep -q "contents: write"; then
         echo "  [!] RISK: $wf has 'contents: write' permission"
      elif echo "$DECODED" | grep -q "permissions:"; then
         echo "  [OK] $wf has scoped permissions."
      else
         echo "  [!] WARNING: $wf has NO permissions block (defaults to write token)."
      fi
    fi
  done
done

echo "[!] Action Required: Explicitly set 'permissions: contents: read' in all workflow YAML files."
echo "[!] Action Required: Disable 'Read and write permissions' in Organization Settings -> Actions -> General."