Security researchers at Noma Security discovered a prompt injection attack called GitLost that can trick GitHub's preview Agentic Workflows into leaking private repository contents publicly. An unauthenticated attacker submits a crafted GitHub Issue to a public repo; if the AI agent has read access to private repositories in the same organization, it retrieves and posts sensitive data in a public comment. The attack bypassed GitHub's prompt-based guardrails with minor wording changes and required no stolen credentials or malware. Experts highlight a deeper architectural problem: AI agents operate on broad service account permissions rather than user-scoped permissions, creating invisible trust boundary gaps. Recommended mitigations include explicit repository whitelists, treating all user inputs as untrusted before reaching the LLM, and having an emergency kill-switch for rogue agents.
