News for hackers. Stuff that matters.

A comment on GitLost: We Tricked GitHub's AI Agent into Leaking Private Repos. Parent comment

Re:GitLost: We Tricked GitHub's AI Agent into Leaking Privat... by lelanthran on Wednesday July 08, 2026 @06:32AM (#48830164)
> You can just make the tool calls restricted/scoped to whatever the calling account has access to (or in this case the repo)

This is a fix for the harness, not the model.

As an analogy to SQL, this is like "fixing" SQL injections by having JS on the frontend escape/sanitise the values sent to the backend, while the backend does not use parameterised statements.

The harness is the front-end, the model is the backend. There is no way to currently fix the backend with parameterised prompts.

[ Parent | on HN ]
Re:GitLost: We Tricked GitHub's AI Agent into Leaking Privat... by codethief on Wednesday July 08, 2026 @07:08PM (#48838583)
It's not even a fix for the harness, as the calling user account's permissions are usually still enough to exfiltrate or manipulate data. See also https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/
[ Parent | on HN ]