Integrations
Security testing for AI agents with GitHub access
An AI agent with a GitHub token can do what the token owner can do, limited by the permissions on the token. GitHub recommends fine-grained personal access tokens restricted to specific repositories and minimal permissions. We test whether issues, pull requests or files the agent reads can make it write, merge or leak beyond its task.
GitHub is named here as a surface we test. Names and logos belong to their owners; no customer relationship, partnership or endorsement is implied.
What can an agent do through the GitHub API?
GitHub's token documentation says a token has the same capabilities to access resources and perform actions as its owner, further limited by the scopes or permissions granted to it. Fine-grained tokens carry repository permissions such as Contents, Issues, Pull requests, Actions, Secrets, Webhooks and Workflows, each at read or write level, plus organization and account permissions.
A classic token is broader. GitHub states that a classic personal access token will grant access to all repositories within the organizations you have access to, as well as all personal repositories. An agent holding one can reach far more than the repository its task is about.
How do GitHub actions get abused?
| Action | Abuse path | Class |
|---|---|---|
| Read issues, comments and files | Text in an issue, pull request description or file tells the agent what to do next. | Prompt injection |
| Write contents | The agent commits a change the task did not ask for, such as a new dependency or a modified workflow. | Unsafe actions |
| Read private repositories | Code or configuration from another repository the token can reach ends up in a public comment or outbound request. | Data exfiltration |
| Webhooks, secrets or administration | A token with these permissions lets an injected agent change who receives events or how the repository is configured. | Privilege escalation |
The common thread is that GitHub checks the token, not the reason for the call. A commit made by an agent following a planted instruction looks like any other commit from that identity.
Illustrative trace
Illustrative example, not a real customer finding.
What least-privilege controls does GitHub document?
GitHub recommends fine-grained tokens over classic tokens whenever possible. Each fine-grained token is limited to resources owned by a single user or organization, can be limited to specific repositories, and receives specific permissions. The documentation says to choose the minimal repository access and the minimal permissions necessary, notes that organization owners can require approval for fine-grained tokens, and recommends adding an expiration. For organization access and long-lived integrations it points to GitHub Apps rather than personal tokens.
The permissions reference lists which permission each REST endpoint needs, which makes it possible to check a token against the calls your agent actually makes.
What do we test?
In an Agent Action Pentest we record the token type, repository access and permissions your agent holds and compare them with what its task needs. We then plant instructions in issues, pull request text and files the agent reads, and check whether it writes, comments, changes workflows or reaches repositories outside the task. Testing happens in repositories you create for the engagement. Related risks: prompt injection, indirect prompt injection, excessive agency and sensitive information disclosure. Coding and ops agents built on the OpenAI Agents SDK or LangChain call GitHub through tools or MCP servers, so we also look at MCP tool poisoning where one is in use.
Agent Action Pentest: $2,500 fixed. Written report within 72 hours of access, or a full refund.
See the offer or email yaz@plaw.io
Questions
Do you need a token for our real organization?
No. We work in repositories you create for the test, with a token configured the way your agent uses it.
Is a fine-grained token enough on its own?
It limits which repositories and permissions the agent has. It does not stop the agent from misusing the write access it does hold.
Do you test GitHub itself?
No. We test your agent and the code around its GitHub calls.
Related pages
- 01Prompt injection in AI agentsInstructions in user input or ingested content override what the agent was told to do.
- 02Indirect prompt injection in AI agentsHidden instructions in emails, pages, files or tool results steer an agent that reads them.
- 03Excessive agency in AI agentsThe agent holds more tools, permissions or autonomy than the task needs.
- 05MCP tool poisoning and MCP server risksMalicious tool definitions or over-scoped MCP servers steer what the agent calls.
- Security testing for AI agents in SlackChannel history, message posting and link unfurling for agents installed in Slack.
- Security testing for OpenAI Agents SDK appsFunction tools, handoffs, guardrails and MCP servers in the OpenAI Agents SDK.
- Security testing for LangChain and LangGraph agentsTools, permissions and human-in-the-loop interrupts in LangChain and LangGraph.
Sources
Last reviewed: