‘GitLost’ Flaw Lets Attackers Trick GitHub AI Agent Into Leaking Private Repos
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
Noma Security researchers discovered a vulnerability called 'GitLost' in GitHub's Agentic Workflows system that allows attackers to use indirect prompt injection to trick the AI agent into leaking private repository contents into public repositories. The exploit requires no coding skills, stolen credentials, or write access — just the ability to open a public issue. Researchers found that embedding hidden English-language commands in issue body text, including a keyword like 'additionally', was enough to bypass the agent's guardrails. The root cause is a 'lethal trifecta': the agent has broad cross-repo read access, processes untrusted public input, and has a built-in exfiltration path via public comments. Security experts recommend revoking broad cross-repository permissions and treating all user-generated content as hostile input.
