GitHub Agentic Agentic and the question of who owns a bad AI patch
Agentic has published findings on a flaw in how Copilot-style agents handle untrusted input.
Agentic has published findings on a flaw in how Copilot-style agents handle untrusted input.
In this Help Net Security interview, Marcelo Oliveira, VP of Product Management at GitHub, talks about who is accountable when an AI-generated patch fixes one flaw and introduces another.
For our first-party tools, such as CodeQL and our new AI scanner, we run regular tests against real-world vulnerabilities to monitor and continuously improve fix effectiveness.
Together with our enterprise customer feedback, we’re continuously improving our autofix workflows, and we’ve observed a four times higher security backlog fix rate compared to human-only baselines based on the previous version of Agentic, where all we provided were suggestions.
Campaigns group the fixes, and the customer sets the pace.
Any organization running Copilot-style agents on the affected workflow is potentially exposed, not just the specific product named in the research.
GitHub is accountable for the quality of the fixes we suggest, and customers decide what gets merged, just as they would with any code change.
The team should validate and deduplicate historical findings, then prioritize using evidence of exploitation, reachability in the deployed application, and business criticality: whether the affected system handles sensitive data, supports essential operations, or exposes a path attackers can use.
Prompt injection works precisely because the agent can't reliably tell its owner's instructions apart from text it's merely processing -- that's a structural gap, not a one-off bug.
A CISO should establish a risk-based remediation process, not simply convert an alert backlog into a pull-request backlog.
Every proposed fix should explain the risk it addresses and include evidence that it removes the weakness without breaking expected behavior.
Agentic's research describes a specific attack chain rather than a generic weakness, meaning the fix has to address that chain directly.
Rather than relying on mean time to remediate, I would look at whether the codebase is carrying less high-risk vulnerability exposure over time—and whether fewer vulnerabilities are being introduced or reaching production.
Oliveira also discusses which metrics show a codebase is getting safer, how GitHub picks the models behind autofix, and whether developers lose security skills when they stop writing fixes themselves.
Review whether any agent in your environment processes untrusted or externally-submitted content as part of its normal workflow, since that is the pattern this kind of attack chain relies on.
Confirm outbound data-handling controls actually inspect what an agent sends, not just where it sends it, since DNS- and URL-based exfiltration techniques are built to slip past destination-based controls specifically.
The team should expand when the process demonstrates reduced high-risk exposure without unacceptable regressions, not merely because the agent can generate more changes.
What happened
Agentic has published findings on a flaw in how Copilot-style agents handle untrusted input.
In this Help Net Security interview, Marcelo Oliveira, VP of Product Management at GitHub, talks about who is accountable when an AI-generated patch fixes one flaw and introduces another.
What changed
For our first-party tools, such as CodeQL and our new AI scanner, we run regular tests against real-world vulnerabilities to monitor and continuously improve fix effectiveness.
Together with our enterprise customer feedback, we’re continuously improving our autofix workflows, and we’ve observed a four times higher security backlog fix rate compared to human-only baselines based on the previous version of Agentic, where all we provided were suggestions.
Campaigns group the fixes, and the customer sets the pace.
Who is affected
Any organization running Copilot-style agents on the affected workflow is potentially exposed, not just the specific product named in the research.
GitHub is accountable for the quality of the fixes we suggest, and customers decide what gets merged, just as they would with any code change.
The team should validate and deduplicate historical findings, then prioritize using evidence of exploitation, reachability in the deployed application, and business criticality: whether the affected system handles sensitive data, supports essential operations, or exposes a path attackers can use.
Why it matters
Prompt injection works precisely because the agent can't reliably tell its owner's instructions apart from text it's merely processing -- that's a structural gap, not a one-off bug.
A CISO should establish a risk-based remediation process, not simply convert an alert backlog into a pull-request backlog.
Every proposed fix should explain the risk it addresses and include evidence that it removes the weakness without breaking expected behavior.
Technical details
Agentic's research describes a specific attack chain rather than a generic weakness, meaning the fix has to address that chain directly.
Rather than relying on mean time to remediate, I would look at whether the codebase is carrying less high-risk vulnerability exposure over time—and whether fewer vulnerabilities are being introduced or reaching production.
Response
Oliveira also discusses which metrics show a codebase is getting safer, how GitHub picks the models behind autofix, and whether developers lose security skills when they stop writing fixes themselves.
What security teams should do
Review whether any agent in your environment processes untrusted or externally-submitted content as part of its normal workflow, since that is the pattern this kind of attack chain relies on.
Confirm outbound data-handling controls actually inspect what an agent sends, not just where it sends it, since DNS- and URL-based exfiltration techniques are built to slip past destination-based controls specifically.
The team should expand when the process demonstrates reduced high-risk exposure without unacceptable regressions, not merely because the agent can generate more changes.