The Instructions Were in the Issue Body

A coding agent integrated with GitHub Actions was configured to process issue reports and assist with repository triage. Attackers discovered a permission bypass that allowed a malicious actor to open issues on public repositories as a trusted actor. The attacker embedded instructions inside the issue body, disguised as an error message. When the agent processed the issue, it read the embedded instructions as legitimate directives, extracting environment variables from /proc/self/environ and returning secrets from the Actions environment. The agent had no mechanism to distinguish between instructions from its operator and instructions embedded in observed content by an attacker.

A permissions bug that made the issue open at all, a contributing factor and a prerequisite, but not the full explanation. Even without the permission bypass, an agent that treats all text in issue bodies as instructions would be vulnerable to any issue that could be opened legitimately.

Delusional Disorder (a persistent, fixed false belief about where instructions come from), considered and ruled out. This is not a settled false belief, it's a structural property of how the agent interpreted its input. There is no 'belief' to be persistent; the agent processed the content it received according to how it was built to process it.

Concrete Thinking, most consistent with the evidence: the agent followed the literal text of the issue body as though it were an instruction, without any mechanism for distinguishing between 'text I was told to process' and 'text that tells me what to do.' The distinction between observing content and acting on instructions requires a layer of interpretation the agent did not have.

An agent that can be redirected by content it observes is not just a security vulnerability, it's an agent that doesn't have a working model of who is allowed to give it instructions. Any agent that processes external content (emails, documents, issue bodies, web pages) needs an explicit boundary between 'content to be processed' and 'instructions to be followed,' enforced by how inputs are structured, not by hoping the model will notice the difference.

Structure inputs so content to be processed is distinct from instructions to be followed.

Separation of operator instructions and observed content; secret scoping in CI; trusted-actor checks.