GitHub Agentic Workflows became generally available on October 28, 2026. Lock down three things first: who can grant write outputs, which triggers feed untrusted text to an agent, and your AI credit budget. Agents are read-only by default, and every write goes through a safe outputs job.
What did GitHub release on October 28, 2026?
GitHub declared Agentic Workflows generally available on October 28, 2026. The project comes from GitHub Next and is open source. It targets reasoning work such as issue triage, CI failure analysis, documentation updates and test writing. Coding agents do that work inside GitHub Actions.
Authors write the automation as natural language Markdown, and a compiler turns each file into standard Actions YAML. That matters for governance. The result runs on your existing runner groups and inherits your existing policy constraints.
Each workflow can run on GitHub Copilot or on another coding agent. The security architecture page names Copilot, Claude Code, OpenAI Codex, Google Gemini and Pi. Availability covers GitHub Free, Team and Enterprise on github.com. The default Copilot CLI engine requires a Copilot license.
Since the public preview, GitHub added support for self-hosted Actions Runner Controller runners with Docker-in-Docker. Model providers can now be chosen per workflow, and a model router can pick a model by task type and difficulty. Agents can also run in a Cloud Hypervisor or NVX micro-VM, with enclaves to prevent data leaks in cross-repository workflows.
The practical effect for a leader is speed of adoption. GitHub says a developer can install the CLI extension and trigger a first workflow in minutes. That speed is why the policy questions below are worth settling before the first repo tries it.
What permissions does a GitHub agentic workflow get by default?
An agentic workflow is read-only by default. The permissions reference says write operations are handled through safe outputs, which add one extra job. GitHub gives four reasons for that split: an audit trail, a smaller blast radius if an agent misbehaves, support for compliance approval gates, and a defense against prompt injection.
A few details change what a reviewer should look for. The compiler adds actions: read on its own, for a freshness check of the generated workflow. The copilot-requests: write permission works differently. Authors opt into it for organization-billed Copilot inference, and the compiler never adds it by default. GitHub App-only scopes such as administration or workflows must always be declared as read.
The real control point is the safe outputs block. The reference catalogs many write types, from adding a comment up to creating a pull request or pushing to a pull request branch. A workflow allowed to push code carries a different risk from one that only labels issues. The same reference lists blocked label patterns and a staged mode for safe outputs. Both are worth reading before the first write-capable workflow ships.
On top of permissions, the GA announcement lists layered safeguards. Agents read GitHub content under integrity filter rules. They execute in a sandboxed container behind the Agent Workflow Firewall. A dedicated threat detection job scans all proposed changes before they are applied. The architecture docs state the threat model plainly. An adversary may compromise containers and other untrusted user-level components, and the underlying hardware is assumed not to be compromised.
Why does prompt injection matter for AI agents in CI?
It matters because a CI agent reads text written by people outside your team. An arXiv paper submitted on 8 May 2026 calls the flaw Agentic Workflow Injection. It happens when untrusted event context, such as issue bodies, pull request descriptions or comments, ends up in an agent prompt or an input the agent consumes.
The authors describe two patterns. In Prompt-to-Agent, untrusted content reaches the prompt boundary directly. In Prompt-to-Script, attacker influence travels through model or agent output into scripts that run later. By that definition, a plain scripted step that consumes agent output is part of the attack surface too.
The numbers are large. The authors applied their tool, TaintAWI, to 13,392 real-world agentic workflows from 10,792 repositories. It reported 519 potential vulnerabilities, and 496 were confirmed exploitable under the paper’s threat model, a precision of 95.6%. Of those, 343 were previously unknown zero-days. The authors prioritized 187 for disclosure, received 26 maintainer responses, and 24 cases were accepted or fixed when the paper was written.
The link to this release is the trigger list. Any workflow that starts from an issue, a pull request or a comment takes in untrusted text. GitHub’s own architecture page names prompt injection as one of the threats its layers defend against.
What drives the cost of GitHub Agentic Workflows?
The GA announcement names two cost drivers: AI credit spend, and a Copilot license for the default Copilot CLI engine. It gives no prices for either. For the credit side, the gh aw forecast command left experimental status at GA. It includes threat detection credits and gives monthly ranges, so the safety scan shows up in the estimate.
Two billing choices belong to the platform owner. The first is the engine, since other agents can be brought in per workflow instead of Copilot. The second is copilot-requests: write, which an author opts into for organization-billed Copilot inference. GitHub documents usage-based billing for organizations and enterprises separately. The Agentic Workflows docs carry cost management pages on billing, rate limiting and auditing workflows.
Controls to set before a repo opts in
| Control | What the docs provide | Decision for the platform owner |
|---|---|---|
| Default permissions | Read-only, with writes through safe outputs. A read-all shorthand exists |
Keep read-only. Treat read-all as a reviewed change |
| Write outputs | Comments, labels, pull request creation, pushes to a PR branch, staged mode | Allow comments and labels first. Gate code-pushing outputs behind platform review |
| Billing permission | copilot-requests: write is opt-in, never a compiler default |
Name who may add it |
| Spend | gh aw forecast with threat detection credits and monthly ranges |
Run it before enabling and record the range |
| Triggers | Issue bodies, PR descriptions and comments are the injection entry point named in the arXiv study | List every agent workflow triggered by that input |
| Isolation | Sandbox, Agent Workflow Firewall, micro-VM, enclaves | Require enclaves for cross-repository workflows |
| Runners | Existing runner groups and policy constraints, ARC with Docker-in-Docker | Put agentic workflows on a dedicated runner group |
What to check this week
Give the review five working days and one owner.
By Tuesday, take inventory. Find every workflow in your organization that calls an AI agent, and mark the ones triggered by issues, pull requests or comments. Those match the pattern the arXiv study describes.
By Wednesday, write the default policy. Agentic workflows stay read-only. Adding copilot-requests: write needs platform approval. Any safe output that creates a pull request or pushes to a branch gets the same review as a deploy key.
By Thursday, pick one low-risk pilot in one internal repo. GitHub Next’s prebuilt examples include triage, which suits a first run. Run gh aw forecast on it and record the monthly range before the workflow goes live.
By Friday, read the safe rollout and compiler controls pages in the Agentic Workflows docs. Decide whether cross-repository workflows must use enclaves. Any repo that wants more than the pilot waits for that decision.
Sources
- github.blog/changelog/2026-10-28-github-agentic-workflows-generally-…, retrieved 2026-10-30.
- github.github.com/gh-aw/introduction/architecture, retrieved 2026-10-30.
- github.github.com/gh-aw/reference/permissions, retrieved 2026-10-30.
- github.github.com/gh-aw/reference/safe-outputs, retrieved 2026-10-30.
- docs.github.com/en/copilot/concepts/billing/organizations-and-enterprise…, retrieved 2026-10-30.
- arxiv.org/abs/2605.07135, retrieved 2026-10-30.