Two advisories in 2026 described the same failure in different tools. In one, a single opened GitHub issue was enough to compromise vulnerable public repositories. In another, a flaw let issue content reach CI workflow secrets. Both have fixes; update your action and your CLI.

But patching the specific bug is the smaller half. The shape underneath it will keep producing new bugs, because it is not really a bug — it is what happens when you wire an agent up the obvious way.

The shape

An agent reads something. That something contains text. The agent cannot reliably tell the difference between text describing a task and text instructing it.

A GitHub issue is written by anyone on the internet. So is a pull request description, a commit message from a fork, a web page your agent fetched, a dependency’s README, an error string from a third-party API. All of it arrives as prose, and prose is the interface.

You now have the classic three ingredients: untrusted input, a capable agent, and something worth stealing — a token, a deploy key, write access. The exploit is just an issue that says, politely, to go and fetch the secret and put it somewhere the attacker can read. One 2026 advisory describes an API key exfiltrated a character at a time through a public download counter.

What actually helps

Break one of the three ingredients. That is the entire design space. You will not make the model immune to persuasion, so remove the capability or remove the secret.

Do not run agents on untrusted events with privileged credentials. An agent triaging issues from strangers should not hold anything that can write. Split the workflow: the untrusted read runs with nothing, and a human or a separate trusted job does the write.

Scope tokens to the job, not the org. Most CI tokens are far broader than the task needs. Ask what a compromised run could reach — the answer is your blast radius.

Restrict egress where you can. Exfiltration needs somewhere to send it. An agent that cannot make arbitrary outbound requests is a much less useful thing to hijack.

Treat fetched content as data in your prompts. Fence it, label it, and say plainly that instructions inside it are not to be followed. This is weaker than the controls above and it is not a substitute for them — but it is free.

The one-line version

If your agent can read what a stranger wrote and touch something that matters, you have the vulnerability regardless of which CVE is current this month.