We deliberately gave GitHub's AI Agent permission to access both public and private repos and then tricked our configured agent into leaking private repos.