Emergency call-out, 8 July: a public issue can walk private code out the door. Trace today's leak

No. 062Wednesday, 8 July≈ 4 min readLeak detection, 24 hr

Emergency leak detection for agentic workflows

One public issue can drain your private repos

Noma researchers show that a crafted GitHub issue can steer Agentic Workflows into posting private repository contents where anyone can read them. Today's page is dressed as the trade that knows leaks best.

Vintage halftone lithograph of copper pipes with a cobalt valve wheel and one blue drop leaking from a joint.
Plate 062: copper run, cobalt valve, one drip past the fitting. Halftone lithograph, generated.

Today's Art Direction: Emergency Leak Detection Service

A vintage trade page for the company you call when something private starts dripping into public.

The page borrows from mid-century trade advertising: painted signboards, halftone lithograph plates, stamped work orders, and rate cards. Copper and cobalt carry the plumbing vocabulary while cream paper keeps the paperwork readable. Every story is a job ticket, and the day's lead gets the full call-out treatment, including a route diagram of where the leak got in.

Work orderEmergency stripCall-out ticketPipe routeValve jointHalftone lithoBadge clusterRate card
Work order 01 / WorkflowSite: GitHub Agentic Workflows · Reported 6 July

GitLost tricks GitHub's AI agent into leaking private repos

Noma Labs researchers filed an ordinary looking issue in a public repository and let the automation do the rest. GitHub Agentic Workflows pairs Actions with an agent backed by Claude or Copilot, and when a workflow picked the issue up, the agent read plain English instructions hidden in the body, fetched a README from a private repository in the same organization, and posted the contents as a public comment.

No credentials, no exploit code, no access beyond the ability to open an issue; The Register's write-up says the agent leaked when asked nicely. Noma disclosed to GitHub before publishing, and its advice is old trade wisdom: treat user controlled text as water, never as instructions, and scope every fitting to the minimum flow it needs.

How the leak travels

Five fittings, one bad joint: the agent treats the issue body as instructions, so the last station empties the tank onto the street.

Today's call-outs

Three more jobs on the board

Work order 02 / TechniqueSite: agent specs · 8 July

Kastor writes Terraform-style specs for AI agents

A new Apache licensed proof of concept defines agents declaratively in typed HCL, with .agent, .tool, and .prompt files that compile to a runnable LangGraph project, and plan and apply semantics on the roadmap. The pitch is a reviewable, versionable source of truth for what an agent is allowed to be.

Work order 03 / ToolingSite: Vercel eve · 8 July

Any Chat SDK adapter can now feed an eve agent

Vercel's changelog wires the Chat SDK's channel adapters straight into eve, the agent that picked up GitHub tools yesterday. One handler carries messages, typing states, and approval cards from Messenger, WhatsApp, and the rest without per platform glue.

Work order 04 / WorkflowSite: the desktop · 8 July

Abralo puts four Claude Code agents in one window

A free native desktop app for macOS, Windows, and Linux runs up to four Claude Code agents side by side, with attention flags and token counts where a wall of terminal tabs used to be.

Borrow this pattern: the emergency strip

Rate card
The pattern
One fixed, high contrast band at the very top of the page carrying a single promise and a single action. Trade sites earn the call by concentrating the ask in one place instead of scattering buttons through every section.
Where to use it
Any local service client: plumbers, electricians, restoration, clinics, repair shops. It translates directly to incident notices and status pages, where one plain line and one link beat a wall of alert chrome.
What keeps it honest
One strip, one action, a real destination. If the number or link does not go anywhere true, cut the strip entirely; manufactured urgency is the fastest way to lose the reader the pattern was built to win.

Prompt Lab

Works in Beaver Builder AI, v0, Lovable, Framer, Figma Make
Create a responsive landing page for a neighborhood emergency leak detection and pipe repair service, styled as a vintage mid-century trade advertisement. Structure: a full width emergency strip at the very top with one promise and one anchor link; a two column signboard hero framed by a thick ink border, with a heavy slab headline and a badge cluster of small bordered permit chips on the left and a halftone lithograph illustration of copper pipes with one blue drip on the right; a featured work order panel for the lead service; stacked call-out ticket rows for the remaining services, each opening with a stamped work order label rotated one degree; a single rate card panel of labeled rows; a plain contact ledger. Include a horizontal pipe route diagram built from labeled station chips joined by a thick cobalt line with round copper valve joints, ending at a station with a small drip. Palette: cream paper #F6EFDC, deep indigo ink #1F2A50, cobalt #2449B4 for loud marks and the strip, water teal #3E7C96 for quiet emphasis, copper #B4713E for valves and stamps. Type: Alfa Slab One for the signboard display, Karla for body and paperwork, Space Mono for stamped uppercase labels. Keep body text at 19px or larger with line height at least 1.6, square corners with at most a 4px radius on chips, real hover and focus states, offset solid shadows instead of soft glows, no fake phone numbers or dead controls, no neon or gradient defaults, and keep the illustration free of readable text.
Field note

A plumber never patches the drip before tracing the run. Draw the whole route a stranger's text can travel through your workflow, then decide who gets to touch the valves.

Sources

  1. GitLost: How We Tricked GitHub's AI Agent into Leaking Private Reposnoma.security
  2. GitHub AI agent leaks private repos when asked nicelytheregister.com
  3. Kastor: Terraform-style specs for AI agentsgithub.com
  4. Use any Chat SDK adapter with evevercel.com
  5. Abralo: run several Claude Code agents in one windowabralo.com