5 ms·
> Responsible Disclosure GitLost was responsibly disclosed to GitHub. Vulnerability details are shared here with their knowledge. Why does this section not hav
by jofzar 2mo ago
> Responsible Disclosure
GitLost was responsibly disclosed to GitHub. Vulnerability details are shared here with their knowledge.
Why does this section not have when it was fixed or GitHub acknowledge/rejected this?
Did they not fix this?
- dzikimarian 2mo agoFix what? They setup LLM with access to private data and ability to read public comments. That's simply misconfiguration.
- wzdd 2mo agoThe OP notes that they had to use special phrasing to get their exfil to work, so clearly GitHub was aware of the issue and made an attempt to prevent it. It seems like the proper fix is for GitHub not to allow their agentic workflow to execute in a public repo context if it also has private repo access. Or, to use your phrasing, for GitHub to flag and disallow this easily-detectable and dangerous type of misconfiguration.
- brookst 2mo agoThis “detectable and dangerous type of misconfiguration” is used by many developed daily and breaking it would break important workflows. It’s like saying that an OS should enforce that home directories can only have 0600 permissions. Yes, it prevents accidentally configuring world readable on files, but there are legit reasons for wanting to share a file from your home dir.
- centuryfall 2mo agoWhy is that an issue though when it is the lesser of two evils? At the very minimum, regardless of “misconfiguration” or not, not having any type of warnings to advise against this behavior is quite bad. Misconfiguration isn’t really the best word choice, either, because it’s definitely a both-sides problem.
- Gigachad 2mo agoThis isn’t a normal software bug, it’s not fixable in the same way you can’t fix regular support staff from being tricked. The answer is you should not allow LLMs access to untrusted input and sensitive data at the same time.
- valleyer 2mo agoYour second paragraph directly contradicts the first.
- LoganDark 2mo agoSince you cannot fix information leakage from LLMs, you must remove the information so that it cannot be leaked. There is no contradiction there.
- valleyer 2mo agoRight, that's the fix. So saying that it's not fixable is incorrect.
- deleted 2mo ago[deleted]
- Gigachad 2mo agoThe LLM is not fixable. Deleting the LLM or crippling it to the point of being useless isn't fixing the bug.
- crote 2mo agoWhy not? If Ford puts a button in their car which blows it up when you press it, removing the button fixes the issue. If your LLM implementation is fundamentally insecure, you'll have a giant gaping security hole until you remove your LLM implementation. The alternative is arguing that having the LLM is worth routinely leaking all your code and secrets and occasionally giving complete strangers full access over your repos. Somehow, I think that's going to be a hard sell.
- jofzar 2mo agoActually op, can you clarify if you did this with the below setting on? There is a literal setting to stop this so I'm curious if this was created because of this report or if this is just negligence from the reporter to not add this as a comment. https://github.github.com/gh-aw/reference/cross-repository/#restricting-cross-repository-reading-toolsgithuballowed-repos https://github.github.com/gh-aw/reference/cross-repository/#...