GitLost: We Tricked GitHub's AI Agent into Leaking Private Repos

📝 Discussion Summary (Click to expand)

1. Over‑permissive LLM agents and insecure permission handling

“When you give an LLM access to all repos, it will inevitably peek at private ones.” — sixtyj

2. Guardrails are ineffective; prompt‑injection is a systemic risk

“Guardrails are either just written prompts or other LLMs checking them, and both fail repeatedly.” — sevenzero

3. Corporate AI push and call for self‑hosted, privacy‑focused alternatives

“Large corporations slap AI onto every product just to claim they’re an AI company; we’re tired of half‑baked integrations.” — neya

🚀 Project Ideas

Generating project ideas…

Provides automatic permission scoping for LLM agents, preventing unintended cross‑repo data exposure.
Centralizes security policies so developers can safely use AI‑powered code assistants.

Key	Value
Target Audience	Developers and teams using GitHub Copilot‑style AI assistants or custom workflow automations.
Core Feature	Real‑time permission manifest generation that restricts agents to the current repository’s scope; auto‑revokes access on policy violations.
Tech Stack	Rust backend, React front‑end, GitHub Actions API, OpenAPI spec for policy definitions, Docker containers.
Difficulty	Medium
Monetization	Revenue-ready: Subscription per active user ($9/mo)

HN commenters repeatedly stressed the need for “trust boundaries” and “scope” for agents (e.g., “Is there a way to segment access per agentic workflow?”). ScopeAgent directly answers that.
Could spark discussion on best practices for permission manifests and integrate with self‑hosted forges like Forgejo for broader adoption.

Acts as a secure proxy that sanitizes and validates user prompts before they reach any LLM, blocking prompt‑injection attempts.
Provides audit logs and policy enforcement to stop accidental data leakage.

Key	Value
Target Audience	SaaS platforms integrating LLMs, enterprise security teams, and hobby developers who expose AI endpoints.
Core Feature	Real‑time prompt parsing with a secondary “judge” LLM that rejects disallowed instructions and flags risky patterns.
Tech Stack	Node.js API gateway, OpenTelemetry logging, Llama‑3‑Judger (open‑source), Redis for rate limiting, Docker Compose.
Difficulty	Low
Monetization	Revenue-ready: Tiered usage‑based pricing (Free up to 1M tokens, $0.001 per extra 1k tokens).

Many HN posts lamented that “prompt injection is unavoidable” and asked for ways to enforce guardrails; PromptShield offers a concrete mitigation layer.
Community could discuss false‑positive rates and integration with existing API‑gateways.

A hosted AI‑assisted code assistance platform that only grants agents read access to the repository they are queried from, preventing private repo leakage.
Includes automated audit and permission revocation based on anomalous behavior.

Key	Value
Target Audience	Companies using GitHub Actions or Copilot‑style tools, especially those with sensitive private codebases.
Core Feature	Integration with GitHub/Gitea/Forgejo that creates per‑repo read‑only tokens for the AI service; auto‑suspends on suspicious output.
Tech Stack	Python FastAPI, PostgreSQL, OAuth2 with fine‑grained scopes, GitHub Apps permission model, Docker Swarm.
Difficulty	High
Monetization	Revenue-ready: Enterprise license with per‑seat pricing ($15/seat/mo).

HN discussions repeatedly asked “Is there a way to segment access per agentic workflow?” and lamented lack of clear guidance from GitHub; AIRepoGate provides that segmentation.
Could generate debate on enterprise adoption vs self‑hosted alternatives, and attract contributors interested in secure AI tooling.