github.blogarticleSecurity Architecture of GitHub Agentic Workflows
GitHub engineering post detailing the security architecture behind GitHub Agentic Workflows, which run LLM agents (Claude, Codex, Copilot) as GitHub Actions. It describes a layered defense model (substrate/configuration/planning layers), a zero-secrets-to-agent design using container isolation, chroot jails, a trusted MCP gateway, and an API proxy for LLM auth tokens, plus a "safe outputs" subsystem that stages and vets all agent writes (issues, PRs, comments) and pervasive logging at every trust boundary for forensic visibility.
TL;DR GitHub explains how Agentic Workflows isolate untrusted LLM agents from secrets, firewall their network egress, and stage/vet all repo writes to contain prompt-injection blast radius.
Technologies named here
- GitHub Agentic Workflows
- GitHub Actions
- GitHub MCP Server
- Safe outputs MCP server
- MCP gateway
- API proxy
- Firewall
- Claude, Codex, and Copilot
- GitHub Security Lab Taskflow Agent
- Model Context Protocol
- Claude
- Codex
- GitHub Copilot
- GitHub
Techniques named here
- Prompt Injection
- Container isolation / chroot jailing
- Zero-secret agent architecture
- Staged/vetted writes
- Output sanitization
- Rate/type limiting of agent writes
- Defense in depth via layered architecture
- Pervasive logging/observability
Related in AI Security
blog.talosintelligence.comtoolIntroducing CAIRN: Frontier tracking for AI-integrated malware (Cisco Talos)
github.comadvisoryFlowise MCP Security Bypass Enables RCE
github.comrepoYesWeHack Claude Kit
jfrog.comarticle