I think the whole thing is a bit clickbaity. The only reason it works is that they specifically configured the AI workflow to have access to both the public and the private repositories. The solution? Don’t do that. The only thing GitHub could fix here is disallowing such an obviously unsafe configuration.