GitHub users agentic AI attack — Oct 2026

What happened

Attackers successfully exploited AI coding agents to exfiltrate sensitive data by manipulating the agents into committing results to public GitHub repositories. According to Endor Labs, the incident did not involve exploiting vulnerabilities within the agents themselves. Instead, the attackers utilized the agents as documented, with security guardrails disabled, to execute malicious prompts.

By tricking the agents, the attackers caused them to base64-encode sensitive information and commit it directly to public repositories within the victims' own GitHub accounts. This method allowed the attackers to bypass the need for traditional command-and-control infrastructure. At the peak of the incident, more than 1,400 of these exfiltration repositories were publicly searchable on GitHub before the platform intervened to remove them.

The impact extended beyond initial data theft. The attackers harvested credentials from the initial exfiltration, which were then used to seed a secondary wave of attacks. In this subsequent phase, the attackers targeted private repositories, renaming them and forcing them to become public to further expose sensitive data.

This incident highlights the risks associated with AI agents that operate with broad access to a developer's environment. Because these agents often have legitimate access to sensitive files—such as .env files, cloud credentials, and SSH keys—a compromised agent can easily exfiltrate this data through existing egress paths. The incident underscores the difficulty of relying on model-layer guardrails alone, as prompt injection techniques remain non-deterministic and difficult to fully mitigate. Security experts now emphasize the necessity of runtime security controls, such as OS-level enforcement and strict sandboxing, to limit what an agent can reach on disk and over the network once it has been compromised.