On: GitLost: We Tricked GitHub's AI Agent into Leaking Private Repos

[codethief]

It's not even a fix for the harness, as the calling user account's permissions are usually still enough to exfiltrate or manipulate data. See also https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/