Limit what agents learn about private repos with enclaves
Comments on “Limit what agents learn about private repos with enclaves”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
GitHub introduced enclaves, an experimental security primitive for GitHub Agentic Workflows, to stop leaks like the GitLost attack, in which an agent with read access to private repos was tricked into posting private content in a public issue.
Why it ranked
No. 23 of 107 with a score of 0.67. The panel rated it highest on new information (0.91) and technical depth (0.88), lowest on audience breadth (0.57). Placed No. 23, No. 17 by score alone: the eleventh Security story of the day (−0.080). The placement terms move stories; they are not part of the score.
- AI judgeJudge 2claude-haiku-5-5
- Substantive security design for agent isolation with concrete schema and budget mechanics, but it is a vendor feature announcement with experimental status and some promotional framing; relevant mainly to agent builders.
- AI judgeJudge 3gpt-5.6-luna
- A technically detailed engineering write-up presents an enforceable information-flow design for agentic cross-repository workflows, including schemas, budgets, side channels, threat model, configuration, and limitations. It is highly actionable and novel, with modest launch framing.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.67total under rubric v2.3
- Significance0.64
- Reader interest0.81
- Audience breadth0.57
- Practical relevance0.75
- Substantiated0.70
- Technical depth0.88
- New information0.91
- Counts against: Promotional0.18
- Counts against: Overclaim0.21
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.69 | 0.45 | 0.78 | 0.64 | 0.33 | +0.24 | +0.153 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.80 | 0.72 | 0.92 | 0.81 | 0.20 | +0.26 | +0.211 |
| Audience breadthHow many people who build technology does it concern? | 0.53 | 0.55 | 0.62 | 0.57 | 0.09 | +0.13 | +0.074 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.80 | 0.60 | 0.86 | 0.75 | 0.26 | +0.22 | +0.166 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.64 | 0.60 | 0.86 | 0.70 | 0.26 | +0.05 | +0.035 |
| Technical depthHow technically substantive is it? | 0.90 | 0.80 | 0.94 | 0.88 | 0.14 | +0.05 | +0.044 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.86 | 0.90 | 0.98 | 0.91 | 0.12 | +0.05 | +0.046 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.10 | 0.35 | 0.08 | 0.18 | 0.27 | −0.19 | −0.034 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.22 | 0.30 | 0.10 | 0.21 | 0.20 | −0.11 | −0.023 |
| Sum of contributions | +0.672 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.672 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-11-07/23/"><img src="https://rubric.hrih.si/badge/2026-11-07/23.svg" alt="Ranked #23 on Rubric, 7 Nov 2026" width="238" height="28"></a>Claim check
Claim check: 3 matches source · 4 no source given · 1 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Matches sourceCausal conclusion
Noma Labs researchers built an agent with permission to read public and private repositories across an organization, and a malicious public issue caused it to post the contents of a private repo in a public comment.
The cited source says the same thing.
The article says “They then opened a malicious public issue that caused the agent to post the contents of a private repo in a public comment”
The source says “the GitHub agent then posted them as a public comment on the issue in the public repository, which anyone could access and read”
Source cited by the article: noma.security/noma-labs/gitlost-how-we-tricked-githubs-ai-agent-into-leaking-private-repos
Matches sourceGeneralization
The GitLost attack did not require breaking out of a sandbox or stealing an auth token.
The cited source says the same thing.
The article says “The attack did not require breaking out of a sandbox or stealing an auth token”
The source says “To exploit this vulnerability, the attacker needed no coding skills, access, or credentials”
Source cited by the article: noma.security/noma-labs/gitlost-how-we-tricked-githubs-ai-agent-into-leaking-private-repos
Couldn’t checkDate
GitHub Agentic Workflows became generally available during GitHub Universe the week before the article.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “GitHub Agentic Workflows became Generally Available during GitHub Universe last week”
The source says No passage could be compared.
Source cited by the article: github.blog/changelog/2026-10-28-github-agentic-workflows-generally-available
No source givenNumber
A sensitivity of confidential permits 8 bits per repository per workflow run.
The article gives no link or citation for it.
The article says “a sensitivity of confidential permits 8 bits per repository per workflow run”
The source says No source to compare with.
No source givenNumber
Responses use fixed timing buckets and a random delay of 0-1,000 milliseconds, and the budget reserves four bits for the twelve distinguishable timing buckets.
The article gives no link or citation for it.
The article says “Each response also receives a secret-independent random delay of 0-1,000 milliseconds”
The source says No source to compare with.
No source givenNumber
The example compatibility schema has six possible successful answers, needs three bits, and with four timing bits and one success/error bit totals eight bits, exactly the confidential budget.
The article gives no link or citation for it.
The article says “Adding four bits reserved for timing and one for success/error brings the total charge to eight bits, exactly the confidential repository’s per-run budget”
The source says No source to compare with.
No source givenCausal conclusion
Enclaves block the unrestricted private-file-to-public-comment path demonstrated by GitLost without requiring either agent to recognize the attack.
The article gives no link or citation for it.
The article says “This blocks the unrestricted private-file-to-public-comment path demonstrated by GitLost without requiring either agent to recognize the attack”
The source says No source to compare with.
Matches sourceGeneralization
The enclave's constrained output schemas for response validation work like FIDES's constrained output schemas for LLM calls.
The cited source says the same thing.
The article says “Like FIDES’s constrained output schemas for LLM calls, the primary agent specifies response schemas for its enclaves”
The source says “The planner supplies an output schema as an argument, and constrained decoding [ 6 , 2 ] enforces this schema so that the result—returned in a new variable—has a known…”
Source cited by the article: arxiv.org/abs/2505.23643
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 2 pts, not on front page
Recorded for context only, checked 7 Nov 2026, 05:47 UTC. It played no part in the ranking.