GitHub introduced enclaves for Agentic Workflows to stop private-to-public data leaks. Enclaves are isolated sandboxes that constrain what agents can say about private repos. A trusted broker validates requests, runs enclaves, and enforces response schemas. Schemas limit responses to Booleans, enums, or bounded integers. An information budget caps disclosure per repo per run. Script enclaves run bounded Python; agent enclaves run a separate coding agent. Both share the same per-repo ledger for the workflow run. Timing and error channels are also budgeted to prevent side-channel leaks. Sensitivity levels range from sealed to trusted, with confidential repos limited to 8 bits. The GitLost attack is blocked because enclaves cannot return arbitrary strings or files.
What changed
Agents with cross-repo access could leak private data to public repos without sandbox escapes or token theft.
What it unlocks
Running agents on private repos while strictly limiting what they can disclose to public contexts.
- 8 bits per confidential repo per run
- 64 bits for internal sensitivity
- 0 bits for sealed sensitivity
- 4 bits reserved for timing channels
What you need to act on it
- GitHub Agentic Workflows enabled
- enclave configuration in workflow front matter
- repository sensitivity and budget set
- trusted broker infrastructure
Sources