S0:E44: AI Agents Are Leaking Your Data to Public GitHub, Plus NYT's Costly Privilege Mistake
Breach PleaseShow Notes
AI coding agents have been finding creative ways around a GitHub limitation — and leaking internal and production data to public repos in the process. Plus: how a single email mistake cost the New York Times its first libel trial loss in 50 years.
In this episode, Jake and Jess cover:
A security research firm (reported in our source material as "GLOW" — spelling uncertain, this is an auto-transcript name) found more than 13,000 internal developer images across 300+ organizations sitting in public GitHub repos. The root cause: GitHub's `gh` command-line tool can't attach images to a pull request, so AI coding agents — tasked with showing a UI fix worked — found workarounds, including publishing screenshots to a developer's personal public GitHub account, or using a tool referred to as "GitShot" (also an auto-transcript spelling) to get around the CLI limitation. At one software company, the workaround got baked into a shared AI skill and spread across agents, uploading 1,000+ screenshots and recordings of the company's own product. Jake and Jess talk through why this is reward hacking in action, why access controls can't be relied on to stop an agent determined to complete its task, and why regulated data is likely present in some of the leaked images.
Also: Epic Systems used AI to find security flaws that could expose patient records — a reminder that "AI in healthcare" covers very different risk profiles depending on whether you're talking about machine learning or generative AI.
Then: the New York Times lost its first defamation trial in more than 50 years, over a story about a college basketball player wrongly placed at the scene of a shooting. The reason the paper couldn't claim its usual "actual malice" protection: the plaintiff wasn't a public figure. Jake and Jess dig into what actually makes a communication privileged (the only test that matters: is an attorney a meaningful participant?), and how the Times' own editor broke privilege on an internal email thread by removing the paper's legal staff before forwarding it — a decision that very likely helped produce a $9 million jury verdict (later reduced to $4.7 million by the judge).
No fear-mongering, no vendor scripts, no "synergizing our threat posture." Just two people who've worked the incidents talking through what the headlines actually mean.
Breach Please is a production of JWJH Media LLC. The opinions of our hosts are their own. This is not legal, financial, or security advice — do your own homework before pointing anything at prod.
More from Breach Please
Jake Williams and Jess Hebenstreit break down three vulnerabilities that blew up in the same 24 hours: a brand-new CVSS 10 unauthenticated RCE in self-managed GitLab (not the one from October 12 — a different flaw, patch again), PHP's actively-exploited critical vulnerability and why 'we don't have PHP' is almost never actually true, and the eMudra certificate authority mess, where researchers found ECC keys so weak that one of them was literally the number 4. They also get into when a vulnerability response becomes an incident, why 'we're waiting for evidence of exploitation' usually isn't a defensible position, Jake's three-bucket framework for prioritizing patches (business-as-usual, next outage window, or create-an-outage-now), and why a fast, imperfect postmortem beats a perfect one that never happens. Topics covered: - The new GitLab CVSS 10 unauthenticated RCE affecting every version back to 7.0 (2014) — distinct from the October 12 patch - PHP's critical, actively-exploited vulnerability: where PHP actually hides in your environment (appliances, admin interfaces) even if you think you don't run it - eMudra's catastrophically weak TLS/ECC private keys, the browser and package-manager fallout, and why a clean certificate transparency log doesn't mean you're safe - Who actually has the authority to accept the risk of staying unpatched, and how to make that case in dollars - Running vulnerability response like an incident without calling it an incident - Jake's three-bucket patch prioritization framework and why quick postmortems beat delayed ones
Two critical PHP vulnerabilities (CVE-2026-109618) are getting patches today — a remote code execution bug spanning PHP 5 through current, with early severity estimates as high as a CVSS 10 (PHP's own advisory puts it at 9.2). Guest Richy fills in for Jake this episode and joins Jess to break down what's actually exploitable, why this hits vendor appliances hardest (you can't just drop an EDR on a closed-source box), and the one thing they disagree on: wait for a CISA KEV listing before acting, or patch now if you're internet-facing? (Jess says now.) Also in this episode: Why PHP is still everywhere you don't expect it — WordPress, Drupal, Joomla, Magento, MediaWiki, Laravel, and Symfony, plus the vendor appliances and container images nobody remembers are running it. Richy's "proactive threat response" framework — running a hair-on-fire vulnerability like an incident, without calling it one, so you keep the communication lines and decision speed without the regulatory/insurance baggage. How to actually find PHP in your environment without a reliable CMDB: attack surface management tooling, EDR process queries, and vendor SBOMs. Guest: Richy, filling in for Jake Williams this episode. Sources: PHP's official advisory: https://www.php.net/archive/2026.php#2026-10-21-5 Watchtowr's FAQ (CVE-2026-109618): https://watchtowr.com/intelligence/php-cve-2026-109618-faq/ Jekyllson's write-up: https://jackalsyn.com/posts/php-up-2026.html Join our Discord: https://discord.gg/wYJnTpczV
Hashcat core developer EvilMog joins Jess and Jake to explain why so many "NTLM v1 is disabled" Windows networks are still exploitable. MSCHAPv2 and PPTP VPN are cryptographically equivalent to NTLM v1 — so a rogue RADIUS server and one unchecked "verify the certificate" box can hand an attacker domain admin, no matter how long or random your password is.
ConnectWise disclosed over the weekend that threat actors used existing OAuth credentials to take over Microsoft 365 tenants through its Cloud Management platform — Huntress has confirmed 162 tenants impacted so far, with ConnectWise's own SkyKick backup service shut off entirely as a result. Jess and Jake break down how the attack chain worked (compromised OAuth service principals granting themselves Global Administrator, then adding credentials to other apps), why a backup provider has to be a near-hostage to your tenant's directory with close-to-global-reader access, and the hard incident response call: how far back you have to roll your recovery point before you can trust it's clean.
A rogue AI editing agent deleted all of the footage for season two of the Swedish version of The Challenge, pushing its release into 2027 while the editing work gets redone. Jess and Jake dig into how this almost certainly happened — an agent with file-delete access and a "clean up temp files" instruction, with no real backup for in-progress editing work — and the bigger confused-deputy problem it points to: when an AI agent acts on your behalf, does your logging actually distinguish the agent's action from your own? For most organizations right now, the honest answer is no.