Why it matters
Wiz examines major AI-powered GitHub Actions and finds authorization mistakes around bot identities, overlooked local credential files, verbose-log leakage, and prompt injection from issues, comments, and pull requests. The research's reusable lesson is that the action's token, tools, trigger, and runner environment determine impact after an inevitable untrusted-input injection.
My takeaway: Authorize automation with stable actor IDs and repository permissions, minimize workflow-token scopes, and never combine pull_request_target privileges with an untrusted prompt. Separate authentication from the AI job, disable sensitive verbose logging, isolate runners, and test every issue, comment, diff, and file as attacker-controlled input.