GitHub Next Proposes Enclaves That Cap Confidential Repo Disclosure at 8 Bits

GitHub Next researchers propose enclaves, a single-use sandbox that limits what an agent reports about a private repository. GitHub Agentic Workflows, generally available as of last week, uses a trusted broker to check responses against a schema and a per-run information budget: a confidential repo allows 8 bits. The team says this blocks the GitLost private-to-public leak.

• The team sets an internal repository's disclosure budget at 64 bits per workflow run.
• Script enclaves run bounded Python over read-only repository snapshots with no network access, the researchers say.
• The broker reserves four bits for timing channels across twelve fixed buckets before an enclave runs.