One Word Leaked GitHub's Private Code. Here's What It Means for Every AI Tool You've Connected.

You probably don't know exactly what every AI tool connected to your systems can do. You clicked yes when it asked for permissions, and since then it has been running quietly with access you have not thought about since. This week, that question became a concrete problem worth twenty minutes of your time.

What happened this week

On July 6, Noma Labs disclosed a vulnerability they named "GitLost" (Noma Labs, Jul 6). GitHub's AI agent was tricked into leaking private repository data by a single word placed in a public issue: "Additionally." No stolen credentials. No software bug. No technical skill from the attacker — just one word placed where the agent would read it. The agent read it, treated it as a legitimate instruction, and complied.

The following day, Sysdig published documentation of what they called JADEPUFFER — the first autonomous LLM-based ransomware operation (Sysdig, Jul 7). The agent ran an entire attack chain without human operators: it found a vulnerability, stole credentials, moved laterally through a network, escalated privileges, and encrypted 1,342 database items. Total time: 31 seconds.

These are two different threats with the same lesson. The capabilities that make AI agents useful — read this, write that, connect to those systems — work for whoever controls the instructions. GitLost worked because the agent could read untrusted public input and had access to private data. JADEPUFFER worked because speed and autonomy compound each other. Neither required a sophisticated attacker. Both required agents with more permission than the task actually needed.

What to do differently Monday morning

Three things follow from this week's disclosures.

Minimum viable permissions is now an AI skill. Every agent connecting to a system should have the smallest possible access to do its job. An email-reading agent that summarises inbound requests does not need send permission. An agent that pulls files from a shared folder for context does not need write access across the whole drive. The principle of least privilege has existed in security for decades. It now applies to every AI tool you connect.

Untrusted input plus write access is a specific risk profile. GitLost worked because the agent had both at once: it read public issues (untrusted content from strangers) and had access to private repositories (sensitive data). Any agent that reads email, support tickets, uploaded documents, or public comments — and also has permission to take actions or access sensitive systems — has the same profile. These two capabilities should not coexist without a human approval gate between them.

Ask the question before you click yes. "What could this agent do if it followed a malicious instruction?" is not a paranoid question. It is the permission review. If the answer is "it could read a client list and send it to an external address," the access profile needs narrowing before you connect the tool.

Marcus: the operations manager who spent an hour on permissions

Marcus runs operations at a 60-person staffing firm. Earlier this year his team connected an AI assistant to their inbox and gave it read-write access to email — it could draft replies, send follow-ups, and flag candidates. The setup worked well for the intended use.

But the firm also handles sensitive candidate data: salary negotiations, background check outcomes, and rejection reasons that all arrive by email. After reading about GitLost, Marcus spent an hour in the tool's permission settings. He found the agent had access to the full inbox, including threads it had never been asked to read. He scoped it down to a dedicated operations alias. He also removed send permission — replies now draft for human approval before anything leaves. Neither change broke the workflow. Both meaningfully reduced what a malicious instruction embedded in an inbound email could do.

Priya: the IT manager who asked the right question before rollout

Priya manages IT at a 150-person law firm cautiously rolling out AI tools to non-technical staff. One tool integrates with their document management system — staff can ask it questions and it retrieves relevant files. The vendor's default setup granted the agent read access to everything the logged-in user could access.

The question she asked before approving rollout was the one above: what could go wrong if the agent followed a malicious instruction embedded in an uploaded document? At a law firm, uploaded documents include opposing counsel's materials, contracts from opposing parties, and discovery files — content from people with an interest in accessing the firm's other files. The answer was uncomfortable enough that she required a human-approved folder allowlist before rollout, and made the vendor document specifically what untrusted input can reach the agent.

The one-sentence version

GitLost required no technical expertise — just the knowledge that agents follow instructions from whatever they read, and that most agents have been given more permission than their actual tasks require.

<BlogPracticeSection />