gh-aw sandbox controlled a credential sidecar browser command

The gh-aw CLI proxy accepted environment values supplied from sandboxed code and merged them into the environment of a more privileged sidecar. The GH_BROWSER variable can select the browser launched by gh browse. In the researcher's controlled test, this converted a browsing helper call into execution under the sidecar's token-bearing process environment, disclosing a real ghs_ job credential.

The starting prerequisite matters. The attacker needed execution in the Agentic Workflow sandbox, not just the ability to send a repository issue from anywhere. The lost boundary was between sandbox-owned execution parameters and the credential custodian; the GitHub credential's eventual reach depended on the permissions granted to that particular job. A separately configured long-lived token could raise the consequence, but the advisory did not establish such a token in every deployment.

The disclosure includes conflicting patch-version descriptions: the advisory metadata identifies 0.91.13 while the body describes a 0.91.12 mitigation. A conservative operational assessment checks the installed sidecar artifacts and regenerated workflow lockfiles at 0.91.13 or later. The fix is effective only if the launched subprocess receives server-owned environment values and cannot inherit an attacker-chosen browser command.