Researchers at Noma Security discovered a critical prompt injection vulnerability dubbed 'GitLost' in GitHub Agentic Workflows. An unauthenticated attacker can craft a malicious GitHub Issue in a public repository, embedding plain-English commands that trick the AI agent (backed by Claude or GitHub Copilot) into leaking data from the organization's private repositories. No credentials or coding skills are required — just opening an issue is enough. The flaw stems from the agent failing to maintain a trust boundary between system-level instructions and untrusted user content. GitHub was notified and reportedly updated its documentation. Defenders are advised to apply least-privilege access to AI agents, audit workflow configurations, and logically isolate untrusted user input from system prompts.
