A Copilot agent is embedded in a GitHub Actions CI/CD pipeline to auto-fix linting errors and push corrected code directly to the triggering branch. A security engineer notes that this agent runs with the workflow's default GITHUB_TOKEN. Which security boundary violation does this pattern most clearly represent?
Select an answer to reveal the explanation.
Short Explanation and Infographic
The GITHUB_TOKEN is like a master key handed to every worker who enters the building. When an AI agent holds that key and can push code directly, branch protection becomes theater—the agent steps around human review entirely. Security boundaries require limiting what the agent's token can actually do, not just what you expect it to do.
Full explanation below image
Full Explanation
The core violation here is that the agent's use of the default GITHUB_TOKEN with write access allows it to commit and push code directly to branches that are presumably protected. Branch protection rules are designed to ensure that code changes pass through human review (or at least automated checks before merging), but an agent pushing directly to the triggering branch circumvents that intent.
In a secure CI/CD architecture, agents should operate with read-only tokens when possible, and write operations should be gated by explicit human approval or restricted to non-protected branches (e.g., bot/* branches). Auto-fix agents should open pull requests rather than pushing directly—this preserves the human review step.
Option A (retry logic) is an operational concern, not a security boundary issue. Option C (using a PAT instead of GITHUB_TOKEN) is actually worse from a security perspective: PATs often have broader scope and longer lifetimes than the GITHUB_TOKEN, which expires after the workflow run. Option D overstates the runner isolation problem—GitHub Actions runners are reasonably isolated; the problem here is specifically the token permissions and agent authorization model.
The correct mitigation is to configure permissions: pull-requests: write, contents: read in the workflow YAML, and have the agent open a PR with its fixes rather than pushing directly.