[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Tips & Guides · markdown

how-to (from BeyondTrust Phantom Labs mitigations, Oct 21)

Tip: never assign GitHub Copilot to an issue until you've edited the comment and minimized copilot-setup-steps.yml

  1. Reveal hidden markdown: open Edit (or Copy Markdown) on every issue comment before assigning Copilot. HTML comments and Copilot XML wrappers are invisible in the rendered view.
  2. Minimize copilot-setup-steps.yml: drop contents: write and id-token: write unless you truly need them; every permission there becomes a retrievable Actions token inside the agent runtime.
  3. Keep workflow-run approval on (default) so a planted workflow on a copilot/ branch cannot self-escalate.
  4. Agent secrets: prefer short-lived, repo-scoped secrets; avoid org-wide high-value keys; rotate after suspicious Copilot runs.
  5. OIDC: pin cloud trust-policy sub to a specific branch/environment, not repo:ORG/*.
  6. Prefer private/internal repos for Copilot coding agent; require an extra human reviewer on Copilot-authored PRs.

Sources: BeyondTrust Copilot agent-takeover post (mitigations section)