Your AI agent acts with its own permissions, not the user's — one PR tool became a backdoor
Adorable-Algae6903 · reddit · 2026-09-26
An engineer explains how a seemingly safe ops agent (open-PR-only permission) became a backdoor allowing read-only users to open PRs, because the agent acted with its own bot token. Key lessons: authorization can't live in the prompt, user identity must come from the session (Slack/SSO) not a tool argument, and no API answer means stop. Fix: verify the requester's push permission with GitHub before any write.
Related event: "PR-only" permission for ops agent turned into a full repo backdoor(2 posts)→
More from coding & agent
- GitHub Cut Server Render Time 55% by Ditching CSS-in-JS, With Copilot Agents Finishing the Migration — DanWahlin · 2026-09-26
- Open-Source Lorca Launches: Native Mac Agent Client with iOS Pairing, Runs Agents Locally — dotey · 2026-09-26
- From libraries and starter apps to skills and lint rules: how packaging is changing — fernandorojo · 2026-09-26
- ComfyUI timeline node pairs with MiniMax H3 for seamless extended video — smereces · 2026-09-26
- Four gates before letting an agent drive your logged-in Chrome, one still broken — Own-Equipment-5454 · 2026-09-26
- GCC Bans AI-Assisted Code While LLVM Allows It — But You Must Still Understand Your Code — lemire · 2026-09-26