This is (yet another) example of agentic computing being the great mixer. It mixes trusted and untrusted, private and public, code and data.

This is the hard part when you build an agentic system : being able to compartmentalise your agents and their permissions. When you find an agent (or its sandbox) that has permissions to reach conflicting domains (public and private repos), then you need to look at it and either split the component, or verify that the output respects your security constraints. It is not a code or prompt injection problem, it is an architectural (bad) choice but it can be fixed at the architecture level too.