diff --git a/.github/workflows/spam-detection-adk-java-issues.yml b/.github/workflows/spam-detection-adk-java-issues.yml
index de7841d3d..dd7b7e324 100644
--- a/.github/workflows/spam-detection-adk-java-issues.yml
+++ b/.github/workflows/spam-detection-adk-java-issues.yml
@@ -76,8 +76,8 @@ jobs:
           DRY_RUN: '1'
           EVENT_NAME: ${{ github.event_name }}
           ISSUE_NUMBER: ${{ github.event.issue.number }}
-          ISSUE_TITLE: ${{ github.event.issue.title }}
-          ISSUE_BODY: ${{ github.event.issue.body }}
+          # ISSUE_TITLE removed: prevents prompt injection; agent fetches via GitHub API
+          # ISSUE_BODY removed: prevents prompt injection; agent fetches via GitHub API
           # Mapped to the manual-dispatch checkbox. On the daily schedule this is
           # empty, so only issues updated in the last 24h are audited.
           INITIAL_FULL_SCAN: ${{ github.event.inputs.full_scan }}
diff --git a/.github/workflows/triage-adk-java-issues.yml b/.github/workflows/triage-adk-java-issues.yml
index 972a9ef35..935feee4c 100644
--- a/.github/workflows/triage-adk-java-issues.yml
+++ b/.github/workflows/triage-adk-java-issues.yml
@@ -66,8 +66,8 @@ jobs:
           DRY_RUN: '1'
           EVENT_NAME: ${{ github.event_name }}
           ISSUE_NUMBER: ${{ github.event.issue.number }}
-          ISSUE_TITLE: ${{ github.event.issue.title }}
-          ISSUE_BODY: ${{ github.event.issue.body }}
+          # ISSUE_TITLE removed: prevents prompt injection; agent fetches via GitHub API
+          # ISSUE_BODY removed: prevents prompt injection; agent fetches via GitHub API
           # Number of issues to process per scheduled batch run.
           ISSUE_COUNT_TO_PROCESS: '3'
           # Comma-separated GitHub handles to round-robin assign issues to.