---
title: Tip: never assign GitHub Copilot to an issue until you've edited the comment and minimized copilot-setup-steps.yml | ctxsec
url: https://ctxsec.com/items/tip-copilot-edit-comments-before-assign
description: ""
status: "how-to (from BeyondTrust Phantom Labs mitigations, Oct 21)"
published: 2026-10-21
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-copilot-edit-comments-before-assign.md)

how-to (from BeyondTrust Phantom Labs mitigations, Oct 21)

2026-10-21

### Tip: never assign GitHub Copilot to an issue until you've edited the comment and minimized copilot-setup-steps.yml

1. **Reveal hidden markdown:** open Edit (or Copy Markdown) on every issue comment before assigning Copilot. HTML comments and Copilot XML wrappers are invisible in the rendered view.
2. **Minimize `copilot-setup-steps.yml`:** drop `contents: write` and `id-token: write` unless you truly need them; every permission there becomes a retrievable Actions token inside the agent runtime.
3. **Keep workflow-run approval on** (default) so a planted workflow on a `copilot/` branch cannot self-escalate.
4. **Agent secrets:** prefer short-lived, repo-scoped secrets; avoid org-wide high-value keys; rotate after suspicious Copilot runs.
5. **OIDC:** pin cloud trust-policy `sub` to a specific branch/environment, not `repo:ORG/*`.
6. Prefer private/internal repos for Copilot coding agent; require an extra human reviewer on Copilot-authored PRs.

Sources: [BeyondTrust Copilot agent-takeover post (mitigations section)](https://www.beyondtrust.com/blog/entry/github-copilot-hidden-prompt-injection-agent-takeover)