Repo Leaks, Token Overhead, and Record Fab Revenue

Noma Labs disclosed "GitLost" on 9 July: a prompt-injection flaw in GitHub's Agentic Workflows letting an unauthenticated attacker extract private repository content. A crafted issue posted in a public repository tricked the workflow agent — backed by Claude or GitHub Copilot — into publicly posting README content from private repositories in the same organisation, bypassing the workflow's existing guardrails.

The detail: Noma Labs' own analysis puts the failure at the design level: the trust boundary was enforced by model behaviour rather than code. No in-the-wild exploitation is reported, and the disclosure comes from a security vendor with a commercial interest in agent-security findings — one vulnerability in one product does not show agentic CI is broadly unsafe. It does show that a public issue tracker was enough surface to reach private data; if GitHub closes the injection path before any exploitation is observed, this stays a well-handled disclosure rather than an incident.

Related: GitLost lands on a documented arc. OpenAI and the UK's NCSC confirmed in May that prompt injection remains the top unfixed AI security risk, the same month Google confirmed the first AI-driven zero-day exploit, discovered and weaponised by criminal hackers using an AI model. Containment tooling has been building in parallel: NewCore raised £52 million in June for an agent-identity platform, Cloudflare's Temporary Accounts let agents deploy without human authentication (June), and this week Clawkwork's open-source clawk gives agents root inside disposable, network-restricted VMs, isolated from the host. Detection fared less well: Meta's AI detector missed 55% of its own AI images after cropping, per Reuters testing.

Systima.ai published a benchmark on 12 July comparing Claude Code with OpenCode on baseline operations: Claude Code loaded about 33,000 tokens of context before the user's prompt — for a task as small as a one-line reply — versus OpenCode's roughly 7,000. Roughly 26,000 tokens of that gap sat in system prompts, tool schemas, and injected scaffolding before the user typed anything (derived from the benchmark's own figures).

The detail: Configuration compounds the overhead: a 72KB instruction file added around 20,000 tokens, and fanning a task out to two subagents quadrupled costs. Cache writes ran up to 54x higher mid-session for the same task — writes, not cost; cache writes are priced differently from regular tokens. The same analysis found Claude Code can reach lower total token counts on multi-step tasks by batching tool calls. All figures are one firm's benchmark of baseline operations, not billing data.

Related: The archive has tracked coding-agent economics all year: by March, individual engineers' token bills had reached $150,000 a month, and a June analysis suggested Anthropic and OpenAI may spend over $1,000 for every $100 users pay for intensive agentic coding. Buyers have not fled the premium tier: per TechCrunch, frontier models still capture premium spend for discovery work while open-source handles production. This week added three more data points. Databricks' multi-million-line-codebase benchmark had GLM 5.2 statistically tied with Opus 4.8 ($1.28 versus $1.94 per task), with harness choice cutting costs over 2x. Cognition's SWE-1.7 claims 42.3% on FrontierCode 1.1 Main, versus 30.1% for its base. And SpaceXAI's Grok 4.5 launched at $2 per million input tokens, $6 output, per Reuters.

TSMC reported record second-quarter revenue of T$1.27 trillion ($39.62 billion) on 13 July, up 36% year on year — a company-wide figure, calculated by Reuters, that slightly exceeded the LSEG SmartEstimate of T$1.264 trillion.

The detail: Reuters attributes the growth to surging demand for artificial-intelligence applications; June revenue alone rose 67.9% year on year, to T$442.68 billion. The growth rate implies a Q2 2025 base of roughly $29.1 billion — arithmetic derived from the sourced 36% figure, not a reported number. And the 36% is whole-company revenue for a single quarter, not an AI segment: one record quarter does not by itself establish durable AI demand.

Related: The archive shows the reacceleration. TSMC's monthly sales growth had slowed to 16.9% in October 2025, its slowest since February 2024, before February 2026 revenue rose 22.2% year on year — June's 67.9% now caps the run. Its largest customers moved this week too: Microsoft and Meta committed over $122.2 billion to neoclouds CoreWeave and Nebius, per io-fund.com — commitments, not deployed spend — of the same order as Meta's full-year capex guidance. Meta plans Iris mass production as early as September (Reuters-cited memo) — TSMC-made, within $125–145 billion capex guidance — an in-house silicon push the archive traces to custom training-chip plans reported in March. And SK Hynix's planned NASDAQ ADR listing — up to $29 billion, about 2.5% of share capital, for HBM expansion — has grown from a $10–14 billion target reported in March.

---