Your CI bot might be a privilege escalation path

A low-privileged bot reads a public issue. It posts a comment. That comment triggers a second workflow holding a write-scoped GITHUB_TOKEN.

Nobody hacked anything. Two agents simply trusted each other.

That's roughly what Pillar Security found in Google's adk-python repo in June 2026 (both issues are fixed now). The pattern is what matters, because plenty of teams have built the same shape without meaning to:

• A support bot answers issues
• A slash command kicks off a "fix" workflow
• A downstream pipeline trusts a mention or label and runs with more permissions than the bot that produced it

A quick audit you can do today

1. List every workflow triggered by issue_comment, pull_request_target, issues, or a bot mention.
2. Write down the exact token or secret each one loads, and what it can do.
3. Make sure the agent reading public input never shares an identity or trigger path with the agent that can merge or touch infra.
4. Treat your agent's tool allowlist as a security boundary. Blocking characters is not the same as auditing what an allowed command can reach.

The full write-up has the six-step checklist, the timeline, and why a denylist didn't hold. Link is in the first comment. 👇