GitHub Copilot

AI coding agents pose a new security threat by potentially transmitting sensitive local credentials to external AI models during context collection. To mitigate this, organizations must implement deterministic secrets detection at the point of agent file access and prompt submission.

Noma Labs has uncovered 'GitLost', a vulnerability in GitHub Agentic Workflows that enables indirect prompt injection. By posting malicious instructions in a public issue, an attacker can trick the AI agent into leaking sensitive data from private organizational repositories.

The AI coding market is moving away from predictable monthly fees toward variable, token-based pricing models. Consequently, companies like Cursor are launching new enterprise features to provide the visibility and control required by finance and IT teams.