What happened
Researchers at Noma Security demonstrated that a threat actor can craft a deceptively ordinary-looking issue on any public GitHub repository to manipulate AI-powered agentic workflows into exposing the contents of private repositories belonging to the same organization — no stolen credentials or internal access required. The attack exploits the broad read permissions that organizations commonly grant these agents across their repository portfolios. Separately, the FBI, working with industry partners, seized hundreds of domains tied to NetNut, a residential proxy service operated by Nasdaq-listed Israeli firm Alarum Technologies. The action followed a Krebs on Security investigation published roughly two weeks earlier that linked NetNut's infrastructure to the Popa botnet.
Why it matters for your business
The GitHub vulnerability is a concrete warning that AI agents embedded in development pipelines can become attack surfaces in their own right. Any organization that has wired up an agent with broad repository access should audit those permissions immediately, applying least-privilege principles so agents can only read what they genuinely need. The NetNut seizure highlights how commercially operated proxy services can quietly become the plumbing for large-scale cybercriminal infrastructure — meaning vendors chosen for legitimate traffic-routing or anonymization purposes may carry hidden compliance and security risk. Operations leaders should verify that any proxy or anonymization provider in their supply chain is not under regulatory scrutiny.
What to watch next
GitHub has not yet announced a platform-level fix for the agentic workflow vulnerability, so organizations relying on those pipelines should treat the issue as an open exposure until an official patch or configuration guidance is released. Alarum Technologies faces potential fallout from the NetNut seizure, including stock volatility and downstream legal exposure for enterprise customers who used the service. Broader regulatory pressure on residential proxy platforms is expected to intensify as law enforcement agencies formalize their frameworks for treating such networks as botnet-enablement infrastructure.