ControlLoopStart free trial

Keep AI agents in CI from holding write tokens with no brakes

Coding agents now run in GitHub Actions to triage issues, review pull requests, and push fixes. When untrusted input triggers the job and the token can write, an attacker's comment becomes the agent's instructions.

Start free trial Get the CLI on GitHub

Team: 7 days free, then $199 a month per organization. Cancel any time. Compare plans →

Untrusted triggers plus write tokens

A workflow triggered by issue_comment runs on text anyone can write. With no permissions block, the job's token gets whatever the repository default grants, which can include write access to contents and pull requests.

Skipping the agent's permission prompts in CI removes the last check. The agent then does whatever the injected text says, with the token's access to your code and, through id-token, your cloud.

What ControlLoop reports on the pull request
.github/workflows/agent.yml
  on:
    issue_comment:
      types: [created]
  jobs:
    agent:
-    permissions:
-      contents: read
      steps:
        - uses: anthropics/claude-code-action@v1
policy.overprivileged-agent-workflowHigh

This change runs Claude Code on issue_comment, untrusted input, with no permissions block, so its token is the repository default.

×
ControlLoop gateDeployment blocked
EXIT 1

What ControlLoop reports

Write tokens without brakes

A workflow is reported when the agent holds a contents, pull-requests, or id-token write token and either skips its permission prompts or is triggered by untrusted input with no explicit permissions block.

Change, not just state

An added or changed over-privileged workflow is high severity. Workflows that already exist are reported as medium on the first scan.

The same gate as everything else

Workflow findings sit beside hook, permission, and MCP findings in one verdict, with the file and line behind each.

How it works

  1. 01

    Find agent workflows

    ControlLoop reads your CI workflows and recognizes the jobs that run coding agents.

  2. 02

    Check trigger and token

    Each job's trigger, permissions block, and prompt settings are compared with the approved baseline.

  3. 03

    Block the risky change

    A pull request that widens the token or removes the brakes is blocked before it merges.

Questions

Which CI systems are covered?

GitHub Actions workflows that run coding agents today. The gate itself runs in GitHub Actions, GitLab, Bitbucket, and Azure DevOps pipelines, or as hosted scans on Team.

What makes an input untrusted?

Triggers whose content outsiders can write, such as issue and pull-request comments. A job triggered that way should declare a minimal permissions block.

Does it check the GitHub token's real permissions?

It reads the workflow's declared permissions. When none are declared, it treats the token as the repository default and reports the risk, since that default is outside the pull request's control.

Go deeper

Read the guide: Claude Code hooks and permissions: what a pull request can grant an agent

More use cases