GitHub introduces enclaves to limit AI agent data leaks in cross-repo workflows

• GitHub Agentic Workflows, now Generally Available, include experimental enclaves to prevent private-to-public data leaks in cross-repository workflows.
• Enclaves act as single-use sandboxes where a trusted broker validates agent requests and enforces information budgets measured in bits, with confidential repositories limited to 8 bits per run.
• Response schemas restrict agent output to Booleans, enumerations, and bounded integers, rejecting free-form strings or arbitrary data that could leak sensitive information.
• The system blocks attacks like GitLost by ensuring the primary agent never sees private repository snapshots, only validated, bounded results from isolated enclaves.

Enclave Mechanics

• Primary agents launch enclaves by specifying a target repository, computation task, and response schema.
• The broker calculates the information charge before execution, reserving budget for the worst-case response including timing and error channels.
• Two executor types are supported: script enclaves for deterministic Python checks and agent enclaves for reasoning tasks with restricted network access.

Security Boundaries

• Timing channels are constrained by fixed buckets and random delays, with four bits reserved for timing and one for success/error status.
• The budget is shared across all calls to a repository within a workflow run, preventing attackers from reconstructing secrets through repeated Boolean queries.
• Enclaves complement least-privilege credentials and do not replace the need for careful provider selection and data-handling policies.