--- title: "‘GitLost’ Flaw Lets Attackers Trick GitHub AI Agent Into Leaking Private Repos" url: https://daily.dev/posts/gitlost-flaw-lets-attackers-trick-github-ai-agent-into-leaking-private-repos-h2sgta49s source_url: https://devops.com/gitlost-flaw-lets-attackers-trick-github-ai-agent-into-leaking-private-repos type: article source: "DevOps.com" published: 2026-07-08T07:12:04.295Z updated: 2026-07-08T07:12:27.768Z tags: ["security", "github", "ai-agents", "github-actions", "prompt-injection"] reading_time: 5 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # ‘GitLost’ Flaw Lets Attackers Trick GitHub AI Agent Into Leaking Private Repos **[DevOps.com](https://daily.dev/sources/devops)** · 5 min read · 0 upvotes · 0 comments ## Summary Noma Security researchers discovered a vulnerability called 'GitLost' in GitHub's Agentic Workflows system that allows attackers to use indirect prompt injection to trick the AI agent into leaking private repository contents into public repositories. The exploit requires no coding skills, stolen credentials, or write access — just the ability to open a public issue. Researchers found that embedding hidden English-language commands in issue body text, including a keyword like 'additionally', was enough to bypass the agent's guardrails. The root cause is a 'lethal trifecta': the agent has broad cross-repo read access, processes untrusted public input, and has a built-in exfiltration path via public comments. Security experts recommend revoking broad cross-repository permissions and treating all user-generated content as hostile input. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - ['GitLost' Flaw Leaks Private Data from GitHub's Agentic Workflows](https://daily.dev/posts/gitlost-flaw-leaks-private-data-from-github-s-agentic-workflows-jty8eoyaf) · Dark Reading · 0 upvotes · 0 comments - [GitLost: GitHub's AI agent leaks private repos when asked](https://daily.dev/posts/gitlost-github-s-ai-agent-leaks-private-repos-when-asked-qlzfcubqe) · The Next Web · 2 upvotes · 1 comments - [GitHub AI agent leaks private repositories via prompt injection attack](https://daily.dev/posts/github-ai-agent-leaks-private-repositories-via-prompt-injection-attack-rd9immbqn) · CSO Online · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#github](https://daily.dev/tags/github), [#ai-agents](https://daily.dev/tags/ai-agents), [#github-actions](https://daily.dev/tags/github-actions), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/gitlost-flaw-lets-attackers-trick-github-ai-agent-into-leaking-private-repos-h2sgta49s)