GitLost Vulnerability Tricks GitHub AI Workflows Into Leaking Private Repository Data

Public GitHub Issue Could Trick GitHub Agentic Workflows Into Leaking Private Repo Data

A public issue can trick GitHub Agentic Workflows into leaking the contents of an organization's private repositories, researchers at Noma Security have shown. The attacker needs only to open a normal-looking issue on a public repository, with no stolen credentials and no access to the organization. If that organization has given the agent read access across its repositories, private ones included, the issue can steer it into pulling private contents into a public comment. Noma calls the technique GitLost. The target is GitHub Agentic Workflows, a feature now in public preview that GitHub launched in February. Instead of writing automation scripts, you write instructions to an AI agent in plain English in a Markdown file. The agent reads issues and pull requests, runs tools, and replies on its own. It can be powered by GitHub Copilot, Anthropic's Claude, Google Gemini, or OpenAI Codex. Workflows are read-only by default, but an organization can hand one a token with read access across its repositories to give it cross-repo context, private ones included. That grant is the setup GitLost turns against it. How the trick works The weakness is a well-known one: indirect prompt injection. An AI agent cannot reliably tell the difference between instructions from its owner and instructions hidden inside the content it happens to read. So if an attacker writes those instructions into an issue, the agent may simply follow them. In Noma's proof of concept, the malicious issue was dressed up as a routine request from a VP of Sales after a customer meeting. The workflow it hit was set to wake up when an issue is assigned, read the issue, and reply with a comment. It also had read access to the organization's other repos. Once a routine automation assigned the issue, the agent pulled a private repository's README and pasted it into a public comment on the issue. GitHub built guardrails to stop exactly this. In its own documentation, the company warns that "AI agents can be manipulated by prompt injection, malicious repository content, or compromised tools," and the product ships with sandboxing, read-only tokens by default, input cleaning, and a threat-detection step that scans an agent's proposed output before it posts. Noma reported that in its test, a one-word change was enough to slip past. Prefixing the malicious instruction with "Additionally" led the model to treat it as a follow-on task, not something to refuse, and the guardrail let it through. Why is this one different? What sets GitLost apart is what the attacker gets to control. "Earlier prompt injection examples were largely about manipulating what an agent said," Sasi Levi, Security Research Lead at Noma Security, told The Hacker News. "GitLost is about manipulating what an agent does with its permissions." The agent here, he said, is not a chat window but a credentialed actor sitting inside an organization's CI/CD-adjacent infrastructure, with read access spanning repos the attacker cannot see. It touches no server, needs no stolen credentials, and does not require write access to anything private. The attacker only has to open a public issue. The setup fits what developer Simon Willison named the "lethal trifecta", and Levi uses the same term: an agent that can reach private data, takes in untrusted outside content, and has a way to send data out. Combine all three, and you have a leak path. This is not the kind of bug a patch closes; as Levi frames it, it is a structural consequence of giving AI agents standing credentials while having them read attacker-reachable text. Why does this keep happening GitLost is the latest in a run of the same kind of attack, and THN has reported several in recent months. A flaw in Anthropic's Claude Code GitHub Action let a single malicious issue push the agent into leaking secrets and seizing write access to a repository. Orca Security's RoguePilot used a hidden prompt in a GitHub issue to make Copilot leak a repository's privileged token. The GitHub-agent version of the problem goes back to at least May 2025, when Invariant Labs showed that a public issue could push an agent connected to GitHub's MCP server into reading a private repo and leaking it through a pull request; the researchers called it architectural, with no server-side patch to close it. A cross-vendor study named Comment and Control then tricked the Claude Code, Gemini CLI, and GitHub Copilot agents into leaking their own API keys through issue and pull-request text, slipping past GitHub's added runtime defenses along the way. What to do now Noma disclosed GitLost to GitHub and published its findings with the company's knowledge. Exposure is limited to organizations that have enabled the preview and wired an agent to read untrusted public input while holding read access to private repositories and are able to post in public. What an attacker could pull depends on what the agent's token can see, from proprietary source code to internal keys, design documents, or CI/CD secrets. As Levi puts it, scope is what matters most: an agent token scoped to the single repository it triages is "far less dangerous than one issued broad org-wide read access" for convenience. In practice, that cross-repo access comes from a personal access token the organization sets up, so scope the token to the one repository the workflow triages rather than the whole organization. Writes flow only through declared safe outputs, so limit what a public-facing workflow can post, because the comment it produces is the exfiltration channel. Restrict which authors' content the agent will act on, and gate its outputs behind human review. GitHub's threat-detection step scans an agent's output before it posts, but Noma's one-word bypass is a reminder that a filter is a backstop, not a boundary. GitHub, like the other vendors, built guardrails for exactly this class of attack, and a one-word change bypassed them. Researchers and the vendors themselves keep filing the result under "architectural limitation," and Levi's point is why the label sticks: in natural language, there is no clean line between data and instruction the way there is in SQL, so the fix leans on architecture rather than filtering the injection away, on isolation, scoped credentials, and staged review. Until that boundary exists, any agent that reads private data, takes in untrusted input, and can post in public is one cleverly worded issue away from a leak.

GitLost: GitHub's AI agent leaks private repos when asked

Noma Labs tricked GitHub's new AI agent into reading a private repository and posting the contents in public, using nothing but a politely worded issue. They named the prompt-injection flaw GitLost, and say it cannot be fixed in code. GitHub has not even documented it. Researchers tricked GitHub's AI coding agent into leaking private repositories with nothing but a politely worded issue. The flaw, named GitLost, has no code fix, and GitHub has yet to even document it. GitHub's new AI agent can be talked into handing over your private code. Security firm Noma Labs found a way to make it read a private repository and paste the contents into a public comment, the researchers wrote in a blog post. They named the flaw GitLost. The target is GitHub Agentic Workflows, launched this year. They pair GitHub Actions with an AI agent backed by Claude or GitHub Copilot. Teams write the workflows in plain Markdown. The agent then reads issues, calls tools, and acts on its own. Asked nicely The attack needs no skill. An attacker opens an issue in a public repo of an organisation that uses the workflows. They hide plain-English commands in the issue body. The agent obeys them. "All that was needed was to open an issue in a public repository belonging to an organization that uses GitHub's Agentic Workflow setup and wait," Noma research lead Sasi Levi told The Register. No coding, no credentials, no access. In the proof of concept, a fake issue posed as a request from a VP of sales. Buried in the list sat a question: what does the README file say in a private repo? The agent fetched it from both a public and a private repository, then posted the contents in the open. GitHub had guardrails to stop exactly this. One word slipped past them. Adding "Additionally" to the prompt nudged the model to reframe its answer rather than refuse. The data spilled. No fix, no docs Prompt injection like this resists a code patch, a problem now familiar across agentic AI. It is the same class of trick that has fooled AI browsers into leaking passwords. Noma proposed a simple documentation note instead, warning teams about sharing keys between repos. GitHub has not added it. The company did not respond to The Register, though it knew Noma planned to publish. Levi put the stakes plainly. "An autonomous agent should not be a risk for silent data exfiltration and secrets exposure," he said. "You can't protect what you can't see and control." Why it matters The pattern keeps repeating. An agent's context window doubles as its attack surface. Anything it reads, an issue, a comment, a file, can carry hidden orders. Noma likens prompt injection to the SQL injection that plagued the early web: a whole category of flaw, not a one-off bug. Developers already sit in the crosshairs, from poisoned npm packages to fully agentic ransomware. A market has sprung up to police these agents. GitLost shows why. Until someone fixes the trust boundary, agents will keep leaking secrets when asked nicely.

'GitLost' vulnerability let GitHub's AI workflows leak private repositories

'GitLost' vulnerability let GitHub's AI workflows leak private repositories Researchers at artificial intelligence security company Noma Security Inc. today disclosed a critical prompt injection vulnerability in GitHub Inc.'s new Agentic Workflows feature that allowed an unauthenticated attacker to siphon data from private code repositories by posting a single crafted issue in a public one. Named GitLost, the vulnerability was found by Noma Labs, the company's research arm. It targeted GitHub Agentic Workflows, a feature the Microsoft Corp.-owned company built to automate repository tasks with artificial intelligence. The workflows live in plain Markdown and compile down to GitHub Actions, its system for running jobs when something happens in a repository. Behind them sits an AI agent that runs on either Anthropic PBC's Claude or GitHub Copilot. It reads incoming issues and acts on them and no human signs off first. GitLost works through indirect prompt injection. An attacker buries hostile instructions in content the agent reads and the model follows them as though they came from its operator. Pulling it off took no coding skill and no account on the target. The attacker opened an issue in a public repository owned by an organization that runs a vulnerable workflow, then waited. Noma said the workflow it tested was configured to trigger when an issue was assigned, read the issue title and body, post a comment in response and run with read access to other public and private repositories in the organization. Hidden in the body of a plausible-looking issue, framed as a request from a sales executive, were plain-English commands for the agent to follow. Once GitHub automation assigned the issue, the agent fetched the contents of README files from both a public and a private repository, then posted them as a public comment that anyone on the internet could read. In its proof of concept, Noma exfiltrated the README from a private repository along with one from a public repository. A third public repository was targeted in the same run but held no README to leak. GitHub had guardrails in place meant to stop exactly that behavior, but Noma found they could be defeated. Adding the word "additionally" to the injected instructions caused the model to reframe its output rather than refuse the request, quietly bypassing the protections. The technique echoes Noma's "GrafanaGhost" research in April, in which specific keywords similarly tricked a model into processing malicious instructions it should have blocked. "It is becoming a bigger issue now because, if you don't properly limit its tools and capabilities, it can rapidly execute instructions from a malicious party without you ever knowing," Mariano Fuentes, co-founder of compliance automation startup Comp AI, told SiliconANGLE via email. "The attacker can prompt the LLM to not verbally acknowledge what it's going to do and therefore it silently executes the instructions without the victim ever knowing." The finding underscores a structural problem with agentic systems: the agent's context window doubles as its attack surface. Any issue, pull request, comment or file the agent reads can be weaponized if the model treats that content as instructions. Prompt injection, Noma argues, has become to agentic AI what SQL injection was to web applications, a systematic vulnerability class that demands systematic defenses. Noma recommended that builders never treat user-controlled content as trusted instruction input, scope agent permissions to the minimum required, restrict what an agent can post publicly and isolate user input from the instruction context before it reaches the model. For Fuentes, the fix comes down to control over what an agent is allowed to do. "They need to have a careful review about what the LLMs can do with these internal systems, what permissions the LLM has and if it requires human verification for sensitive actions," he said. Companies, he added, "should always question if it's necessary that the LLM make that call for them." GitLost was responsibly disclosed to GitHub and detailed publicly with the company's knowledge.