GitHub's documentation says its Copilot cloud agent pushes to a single branch, cannot approve or merge pull requests, needs a human to approve workflow runs, runs behind a firewall, filters hidden content such as HTML comments, and signs its commits. Several of these checks can be adjusted by admins, so verify your settings.
Definitions
Cloud coding agent. An agent that works on a task in a hosted environment and opens a pull request with its changes.
Workflow approval. A step where a person with write access clicks to allow Actions workflows to run on the agent's changes.
Risk and safeguard table
| Risk | Safeguard described by GitHub |
|---|---|
| Insecure code | Runs CodeQL, checks new dependencies against the GitHub Advisory Database, scans for secrets, gets a second review. Admins can disable these checks |
| Unwanted pushes | Only users with write access can trigger it. Pushes to one branch, cannot run git push directly, draft pull requests need human review, cannot approve or merge |
| Workflows running unreviewed code | Workflows do not run until a user with write access approves. Admins can allow automatic runs |
| Data leakage | Internet access restricted by a firewall that can be customized or disabled |
| Prompt injection | Hidden content such as HTML comments in issues and comments is filtered before reaching the agent |
| Loss of visibility | Commits are authored by Copilot, co-credit the requester and are signed. Session logs and audit log events support tracing |
| Unattended automations | Attributed to their creator, can be limited to specific tools, ignore events from users without write access by default |
What to take from it
- Review is built in, by design. The agent cannot approve its own work. Keep branch protection and required reviewers so that stays true.
- Checks are optional settings. Because admins can disable the security checks, confirm they are on and add your own required checks in CI.
- The firewall is a control you own. If you widen it, you widen what a manipulated agent can reach.
- Hidden content filtering is partial. It addresses one hiding place. Other injection routes in issue text remain, so keep human review of what the agent was asked to do.
- Treat automations as identities. Each should be attributed, scoped and reviewed like a service account.
A checklist to verify your own setup
- Is write access to the repository limited to people who should be able to trigger the agent?
- Are the code scanning, dependency and secret checks enabled for agent changes?
- Do required status checks and reviews apply to the agent's branch?
- Is workflow approval left on?
- Is the network allowlist as small as the work allows?
- Can you trace an agent commit back to the requester and the session?
Try it yourself
Click through it at your own pace, or open it full screen. It shows a pull request held at a gate, the same idea as the approve-before-run step.
Quick check
Can the agent merge its own pull request?
Per GitHub's documentation, no. It cannot approve or merge pull requests, and its draft pull requests need human review.
Are the built-in security checks mandatory?
No. Admins can optionally disable them, so confirm the setting and add required checks in CI.
Is this the same for other coding agents?
No. Each tool has its own controls. Use this table as a template of questions to ask any agent.
Where Safeguard fits
Safeguard provides dependency scanning, SBOMs, reachability analysis and pull request gates that sit alongside the checks above. You can try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
