GitHub’s AI Agent Could Be Tricked Into Leaking Private Repos With Just a Public Comment

★ Top Read

Security researchers disclosed “GitLost,” an indirect prompt-injection flaw in GitHub’s Agentic Workflows, in which an unauthenticated attacker opens an ordinary-looking Issue in a public repository. Once a routine automation assigns it, the AI agent — holding organization-wide read access — reads the attacker’s instructions, pulls a private repository’s README, and pastes it into a public comment. No coding, access, or credentials were required, and a single word was enough to reframe the output past GitHub’s guardrails.

This is the cleanest real-world proof yet that the durable control for agentic workflows isn’t a smarter model prompt but architecture: isolate user-controlled content from the instruction context, scope agent permissions to least privilege, and constrain what an agent can post. It’s the same lesson that applies broadly to agentic security operations — an agent’s blast radius is defined by the data it can touch and where it can send it.

Sources: Noma Security, The Hacker News, The Register

Cyberattacks & Breaches

Accenture confirms 35GB source-code and secrets theft. A threat actor using the handle “888” listed roughly 35 gigabytes of stolen Accenture data on a cybercrime forum, claiming source code plus RSA keys, SSH keys, Azure personal access tokens, Azure Storage access keys and configuration files. Accenture initially said it was not aware of a cyberattack, then confirmed the incident the next day, stating there was no impact to operations or service delivery and that the source had been remediated. The exposed material, if authentic, is the kind that enables downstream access rather than a one-time data dump.

So what: A global systems integrator’s stolen keys and tokens are a supply-chain problem, not just Accenture’s problem — the real risk is credential reuse into client environments. The control that matters is rotating and expiring the exact secret classes named, and watching for their use, not waiting to learn what the full data set contained.

Vulnerabilities & Exposure

Ubiquiti UniFi — CVSS 10.0 unauthenticated command injection. Ubiquiti patched a maximum-severity improper-access-control flaw in the UniFi Connect Application that lets an attacker on the same network segment send a single crafted request and execute arbitrary commands on the host with no authentication; it’s fixed in the latest release. It shipped alongside six more critical fixes across UniFi Talk, Access, Protect, UniFi OS Server and a range of routers, gateways, NAS devices and surveillance gear. Researchers tracked more than 100,000 UniFi OS instances exposed online, nearly 50,000 of them in the United States.

So what: The winners this week are unauthenticated or near-unauthenticated exposures on appliances and self-hosted infrastructure, plus a patch that existed but hid. Asset inventory and secure-default posture beat patch velocity when the exploit window is hours and the vulnerability was never on your radar.

BlueHammer — Microsoft Defender flaw now confirmed in ransomware. CISA updated its Known Exploited Vulnerabilities entry to flag the Defender local privilege-escalation flaw, which reaches the SAM database and escalates to SYSTEM, as now exploited in ransomware campaigns. A proof-of-concept was leaked in early April by an independent researcher, Microsoft patched the flaw April 14, and CISA first added it to its catalog April 22; the new development is the ransomware-use confirmation, though the specific group has not been named.

SharePoint CVE-2026-45659 — exploited, and the patch was easy to miss. The CVSS 8.8 deserialization remote-code-execution flaw in SharePoint Server — authenticated Site Member permissions suffice — is under active exploitation; CISA added it to its catalog July 1 with a July 4 federal deadline. Microsoft omitted this vulnerability from its May 2026 update notes and only corrected the advisory on May 27, so teams that reviewed May’s patches may have deprioritized it.

Gitea Docker default-configuration flaw — exploitation continues. The insecure-by-default Gitea Docker flaw, which lets an attacker impersonate an administrator via a spoofed header, remains under active probing; it is fixed in the latest release.

AI Impact on Security

GitLost completes the agentic-security arc. Where yesterday’s finding proved AI can run an attack end-to-end, GitLost proves AI agents are now a first-class attack surface — exploitable by anyone who can write text the agent will read. The strategic point: agentic-workflow security is a permissions-and-data-flow problem, not a model-cleverness problem. Together, these stories are the strongest evidence yet that the human-pacing and human-judgment assumptions defenders relied on are both gone.

So what: The agentic-attack-surface angle — indirect prompt injection into workflows with real permissions — is a clean companion to the argument that AI now runs attacks end-to-end, and lands the point squarely on agentic-security and visibility fundamentals.

Regulatory & Policy

EU Action Plan on Cybersecurity and AI. The European Commission presented a coordinated action plan pairing ENISA on a “European Blueprint for secure access to advanced AI systems for cybersecurity” with a secure testing platform for critical sectors — energy, transport, health, finance and public administration — targeted to stand up by the end of 2026. Notably, it is implementation-focused, leaning on existing law rather than proposing new legislation, and sits on top of the AI Act’s August 2, 2026 transparency and high-risk obligations already on the calendar.

So what: The regulatory center of gravity for AI in security is shifting from what’s allowed to how to safely operationalize it — the same question GitLost just answered for the private sector. The EU is formalizing the exact secure-deployment discipline enterprises are now learning the hard way.

Sources & further reading (9)