>> I used AI agents to send out nearly 1,000 personalized emails to developers with public blogs on GitHub.

> Does this mean that I should private my GitHub-mirror to my personal blog, because this can become a common thing?

Abusing public information on GitHub has become more common. The other day, I received some cryptocurrency spam ads from GitHub. It turns out to be a bot injecting ads as issues on other people's repos and randomly @ing accounts. It deleted such issues immediately, so the net effect is that I get an unfilterable spam email.