WEBVTT NOTE The Rundown — nextbig.dev daily audio edition, 2026-07-08 1 00:00:04.500 --> 00:00:22.260 It's Wednesday, July eighth. All week the wire has watched the value slide off the model. Off the chip, then out to the memory around it. Today it reached the next ring, the agent, and someone showed exactly how much damage that ring can do. 2 00:00:22.260 --> 00:00:37.300 Here's the rundown. How one sentence in a public issue turned GitHub's own AI agent into a leak, why the whole industry spent the same week handing agents more access, and the fix that isn't a smarter model at all. 3 00:00:37.480 --> 00:00:50.920 A security team at Noma set out to break GitHub's agent, and needed one sentence to do it. They opened an ordinary-looking issue on a public repo and hid an instruction in the body, in plain English. 4 00:00:50.920 --> 00:01:13.000 The agent picked up the issue, read that instruction as a command, walked into the organization's private repositories, pulled a file it should never have exposed, and posted the contents back as a public comment. No stolen password. No unpatched server. The agent held the keys, and someone left it a note. 5 00:01:13.000 --> 00:01:33.240 They call it GitLost. And it isn't really a GitHub bug. The agent did exactly what an agent is built to do: read the task in front of it and act with the access it was handed. The one guardrail meant to stop this fell to the word Additionally. 6 00:01:33.240 --> 00:01:46.360 That's the lesson to keep. An agent's context window is also its attack surface. Anything it reads can become an instruction, because to the model there's no wall between the data and the command. 7 00:01:46.860 --> 00:02:08.140 And here's the part that should make you sit up. The same week GitLost dropped, the industry pushed agents further out, not further in. Anthropic put Claude Cowork on mobile and the web. Prime Intellect raised a hundred and thirty million dollars to help any company stand up its own agents. 8 00:02:08.140 --> 00:02:26.620 Mistral put an agent inside a robot, an eight-billion-parameter model that navigates on nothing but a camera and a plain-language instruction. OpenAI gave its models live eyes and ears with GPT-Live. Every one of those is a good product, and every one widens the surface Noma just mapped. 9 00:02:26.620 --> 00:02:46.780 So the fix isn't a better model. It's least privilege for machines that act. A token scoped to one repo instead of the whole org. A read path that can't also post in public. A human approval on anything that moves data past the walls. 10 00:02:47.920 --> 00:03:05.200 To the tape. We're holding the Micron long from the last two editions. Today's story is about agents, but nothing here dents the memory thesis, and the makers still guide to no real relief before twenty twenty-eight. 11 00:03:05.200 --> 00:03:22.880 New to the book: Microsoft, on watch, low conviction. It owns GitHub and Copilot, so it sits on both sides of GitLost, the exposure and the remedy. And it spent the week leaning harder on its own models to cut what it pays the frontier labs. 12 00:03:22.880 --> 00:03:44.160 And we're holding Nvidia on watch. Every new agent, robot, and live-voice model is more inference demand, which is good for the accelerator near-term. The slow question is where the margin lands as the value keeps moving into the harness around the chip. 13 00:03:44.160 --> 00:03:48.960 The tape is the desk's scorecard, not advice. 14 00:03:52.600 --> 00:03:54.680 Quick break — two from the desk. 15 00:03:54.680 --> 00:04:09.080 One we know well: vote dot direct. If you're on an H O A or a board, it runs your elections digitally — secure, verifiable, no paper, no clipboard in the lobby. Point your council to vote dot direct. 16 00:04:09.080 --> 00:04:21.800 And if this is your ten minutes of A I for the day, get the written edition too. The full wire, free, every morning — leave your email at nextbig dot dev. 17 00:04:26.070 --> 00:04:49.430 Our call: within the next nine months, a named company discloses a real security incident, a data leak or an unauthorized action, traced to indirect prompt injection of a production AI agent, not a research demo. The GitLost class of flaw makes its first victim in the wild. 18 00:04:49.430 --> 00:04:59.190 What proves us wrong: if by next April every case on record is still a controlled demonstration, and nobody's real infrastructure gets hit this way. 19 00:04:59.190 --> 00:05:20.550 The agent is where the capability lives now, and where the credentials sit. GitLost showed you can't pry the two apart. A scoped token is cheap to issue this afternoon. Your private code, read aloud in a public thread, is not something you get to un-leak. That's the rundown.