Three changes in ten days each widened what an agent in your workflow can reach or be started by.
None of them is a problem. Together they are a reason to spend twenty minutes looking at permissions you last set months ago.
What changed
- 29 July — Copilot code review reached GA with MCP, so the reviewer can read from systems you connect
- 3 August — Cursor added Gmail, Drive and Calendar plugins, so the editor can read your workplace documents and mail
- 4 August — Copilot automations can be triggered from a comment, so a new set of people can start a job
The read-access audit
For every connection an agent has, answer one question: if the contents of this system appeared in a pull request comment, would that be a problem?
- MCP servers — scope to read-only where the distinction exists, and to the narrowest view of the system rather than the whole thing
- Workspace plugins — check whether the connected account is a work account; a personal Gmail connection reaches mail that has nothing to do with the repository
- Any connection made by an individual rather than an administrator, which is the category most likely to be over-scoped
The trigger audit
For every automation that can now be started by a comment:
- List who can comment on the repository — on public repos, that is everyone
- Check what permissions the triggered job runs with; opening a pull request is very different from merging one
- Confirm there is an audit trail linking a trigger to a person
Why today rather than eventually
GitHub tightened supply-chain defaults on 28 July precisely because volume, not malice, is the threat model now. The same logic applies here: nobody is attacking you, but the surface grew three times in ten days while nobody was reviewing it.
A permissions audit is boring, takes under an hour, and is the only item in this month's news that has no downside.