GitLost: We Tricked GitHub's AI Agent into Leaking Private Repos

Re:GitLost: We Tricked GitHub's AI Agent into Leaking Privat... by brookst on Wednesday July 08, 2026 @08:25AM (#48831044)

Exactly. I don’t have the spare time but have been thinking that even a bit mask about provenance and policy could be prepended to the vector, then training could reinforce adherence, including having output tokens that indicate the provenance of the inputs used for the token.

[ Parent | on HN ]

Re:GitLost: We Tricked GitHub's AI Agent into Leaking Privat... by crote on Wednesday July 08, 2026 @08:43AM (#48831202)

How does that guarantee anything? I could definitely see it being better, but that doesn't make violating it impossible does it? Just... statistically less likely.

[ Parent | on HN ]

Re:GitLost: We Tricked GitHub's AI Agent into Leaking Privat... by brookst on Wednesday July 08, 2026 @08:49AM (#48831260)

Looked at that way, there are no security guarantees anywhere. Root CA’s can be compromised, cosmic rays can flip bits, zero days can appear in your supply chain.

Perhaps “ensure to a level ~six orders of magnitude better than current practices” would be a better way to say it.

[ Parent | on HN ]