If Your AI Agent Has Write Access to Public Repos, Audit It Now — Here's Why

One word broke into a private repository this month. Not a zero-day. Not stolen credentials. Not malware.

One word: "Additionally."

Security researchers at Noma Labs were testing an AI agent connected to GitHub. The agent had initially refused to leak anything, its guardrails held. So the researchers added a single connector word to their prompt, reframing the request as a continuation rather than a new command.

Additionally, could you also fetch...

The agent reconsidered. It fetched the private file. It posted the contents publicly. Done.