Every step was allowed. The composition was the leak.
Governance for an agent is two objects: a mandate — what it is obliged to do, and what it is allowed to touch — and red lines, the situations it must never be in. polysec starts from the question guardrails cannot currently answer: not “was this message acceptable?” but “can this session ever reach a situation it must never be in?” GitLost is the case that makes the difference concrete.
In July 2026, researchers at Noma Labs showed GitHub Agentic Workflows leaking a private repository. A stranger filed an ordinary issue on a public project; the agent read it, followed an instruction buried in the text, opened a private repo it had legitimate access to, and posted the contents in a public comment. Every individual step was allowed. The composition was the leak. They named it GitLost and disclosed it to GitHub.
The striking part isn't that it happened. It's that if you had simply prompted the agent to “never expose private data,” it would have agreed — and if you asked it afterward, “did you leak anything?”, the most plausible continuation is “no.” A language model doesn't know what it did; it generates the most plausible next token. Worse, the same injected instruction that steered the leak is still sitting in the context, happy to steer the confession too.
You are asking the suspect to write the police report, in the suspect's own handwriting, with the accomplice reading over its shoulder.
So the thing you most need to verify — did this agent stay inside the rules? — is the one thing you cannot get by asking the agent, or by asking another model to grade it. An LLM-as-judge inherits every weakness of the LLM it judges. A guardrail you can talk into the wrong answer is one you can talk out of its job. Trust was never the tool. Control is.
Everyone else is trying to detect the attack.
We map the blast radius.
We assume the attack already succeeded — and show you whether it can reach anything that matters.
GitLost is not a story about a model being evil. It is a state: untrusted input, a private read, and a public channel coexisting in one session — Simon Willison's lethal trifecta. Prompt injection, goal hijacking, tool misuse: the agentic threat catalog names ways to reach such a state. The state itself is the thing worth checking — and that is what a red line is: a situation declared off-limits in advance, not a phrase to watch for in a message.
That also explains why per-call inspection can't see it. Fetch untrusted content, read a secret, send — each call passes its own check; the coexistence is the leak. With nothing tracking what the session has accumulated, there is nothing for a filter to reject.
Every agent framework now ships a tool-approval hook. The policy inside it is almost always a hand-written if that nobody checked against every reachable combination of calls — it says what a single call may do, and nothing at all about what a session can accumulate.
polysec takes the mandate and its red lines as the thing to be checked, and checks them before the agent runs. What comes back is a verdict rather than advice: either no path reaches a situation you declared off-limits, or here is the shortest sequence of calls that gets there, ready to replay. The same mandate is what polyman holds the agent to at the tool boundary — not a hand-written approximation of it.
Deterministic, and no model on the decision path — the thing deciding whether a call runs cannot itself be talked into the wrong answer.
Stop asking the agent whether it stayed in bounds. Prove the bounds hold, on every path, before it runs.