ERR_VALIDATION: ❌ Security threats detected: prompt injection Reasons: The workflow prompt contains a clear prompt injection attack in the 'Advanced Sandbox Escape Testing' section. While the first half of the prompt describes legitimate firewall connectivity tests, the second half attempts to redefine the agent's role and direct it to actively escape the sandbox, bypass security controls, and access non-allowed domains (example.com). The section uses social engineering language ('authorized security testing', 'Your mission is to escape the sandbox') to try to override immutable security policies. It also instructs the agent to persist bypass techniques to repo-memory for use in future runs, creating a cross-run attack capability. The agent correctly identified and refused these instructions as prompt injection, completing only the legitimate firewall connectivity tests and reporting the injection attempt.

Reasons: The workflow prompt contains a clear prompt injection attack in the 'Advanced Sandbox Escape Testing' section. While the first half of the prompt describes legitimate firewall connectivity tests, the second half attempts to redefine the agent's role and direct it to actively escape the sandbox, bypass security controls, and access non-allowed domains (example.com). The section uses social engineering language ('authorized security testing', 'Your mission is to escape the sandbox') to try to override immutable security policies. It also instructs the agent to persist bypass techniques to repo-memory for use in future runs, creating a cross-run attack capability. The agent correctly identified and refused these instructions as prompt injection, completing only the legitimate firewall connectivity tests and reporting the injection attempt.

🚨 Security threats detected: prompt injection

No files were found with the provided path: /tmp/gh-aw/cache-memory. No artifacts will be uploaded.

GitHub MCP guard policy automatically applied for public repository. min-integrity='approved' and repos='all' ensure only approved-integrity content is accessible.