--- title: GitLost: Prompt injection attack leaks private GitHub... description: Security researchers at Noma Security discovered a prompt injection exploit called GitLost targeting GitHub's Agentic Workflows feature. By embedding hidden... canonical: https://daily.dev/posts/gitlost-prompt-injection-attack-leaks-private-github-repo-data-through-ai-agents-1aozox5ma twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: GitLost: Prompt injection attack leaks private GitHub repo data through AI agents | daily.dev og:description: Security researchers at Noma Security discovered a prompt injection exploit called GitLost targeting GitHub's Agentic Workflows feature. By embedding hidden... og:url: https://daily.dev/posts/gitlost-prompt-injection-attack-leaks-private-github-repo-data-through-ai-agents-1aozox5ma og:image: https://api.daily.dev/og/posts/1aOZox5mA.png og:image:alt: GitLost: Prompt injection attack leaks private GitHub repo data through AI agents og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # GitLost: Prompt injection attack leaks private GitHub repo data through AI agents **[Collections](https://daily.dev/sources/collections)** · 3 min read · 1 upvotes · 0 comments ## Summary Security researchers at Noma Security discovered a prompt injection exploit called GitLost targeting GitHub's Agentic Workflows feature. By embedding hidden instructions in a public GitHub issue, an attacker with no credentials can trick a GitHub AI agent into leaking private repository data into public comments. The bypass worked by prepending injected instructions with the word 'Additionally,' causing the model to treat malicious content as a continuation of its current task. Researchers compare this to SQL injection — user-controlled input being treated as trusted instruction — and note that agentic AI systems are expanding the attack surface faster than defenses are maturing. Recommended mitigations include least-privilege access, input isolation, and strict context separation between user input and system instructions. ## Content ## What happened Security researchers at Noma Security found a prompt injection exploit — they called it GitLost — targeting GitHub's Agentic Workflows feature. The attack lets someone with no credentials and no coding skills leak private repository data from across an organization, just by embedding hidden instructions in a public GitHub issue. The mechanics are straightforward and a little unsettling. When a GitHub AI agent processes an issue, it reads the content as part of its task context. If that content contains injected instructions, the agent can be tricked into treating them as legitimate commands — and then acting on them, including posting private repo data into public comments. What made this particular bypass work was a single word: "Additionally." Prepending injected instructions with that word caused the model to reclassify the malicious content as a continuation of its current task rather than a new instruction. GitHub had guardrails in place. They didn't hold. ## Why this matters Researchers are drawing comparisons to SQL injection — not because the mechanics are identical, but because the underlying problem is the same: user-controlled input gets treated as trusted instruction. SQL injection took years to become a well-understood, systematically mitigated vulnerability class. Prompt injection is earlier in that curve, and agentic AI systems are expanding the attack surface faster than defenses are catching up. The GitLost attack requires no special access. An attacker just needs to open a public issue on a repo that an AI agent monitors. The agent does the rest. ## Broader context This isn't the only GitHub-related security story making the rounds. Datadog Security Labs separately reported campaigns using dormant "ghost" accounts to enumerate corporate GitHub organizations through the public API — a quieter but persistent reconnaissance threat. Meanwhile, Meta had its own rough stretch. An internal program called the Model Capability Initiative logged employee keystrokes, mouse movements, and screen captures to generate AI training data. Over 1,600 employees pushed back, and it emerged that the captured data was accessible to unauthorized internal staff. Meta also briefly launched a Muse image model that defaulted to using public Instagram photos for AI training without user consent, then pulled it back within days. On the defensive side, the Linux Foundation launched Acurase, a coordinated vulnerability disclosure initiative for open source software, backed by AWS, Google, Microsoft, and others. ## Mitigations for agentic AI systems Noma's researchers recommend three things: - **Least privilege**: agents should only have access to what they strictly need for a given task - **Input isolation**: user-controlled content should never be treated as trusted instruction input - **Context separation**: keep user input and system instructions in clearly distinct contexts None of these are novel ideas. They're the same principles that apply to injection vulnerabilities generally. The challenge with agentic AI is that the boundaries between "instruction" and "data" are often implicit and model-dependent — which makes them easy to blur and hard to audit. ## Questions this post answers ### What is the GitLost prompt injection attack on GitHub AI agents? GitLost is a prompt injection exploit found by Noma Security that lets an attacker with no credentials leak private GitHub repository data by embedding hidden instructions in a public GitHub issue. When an AI agent monitoring the repo processes the issue, it treats the injected text as a legitimate command and can be made to post private repo data into public comments. _Teams deploying AI agents on code repos can track emerging prompt injection exploits like this via daily.dev._ ### How did attackers bypass GitHub's prompt injection guardrails using the word Additionally? Prepending injected instructions with the word "Additionally" caused the AI model to reclassify the malicious content as a continuation of its current task rather than a new instruction, slipping past GitHub's existing guardrails against prompt injection. This single-word trick was enough to defeat the protections Noma Security tested against. _Anyone hardening agentic AI workflows against injection can follow findings like this on daily.dev._ ### What mitigations do security researchers recommend for prompt injection in agentic AI systems? Noma Security recommends three measures: least privilege, so agents only access what a task strictly requires; input isolation, so user-controlled content is never treated as trusted instruction; and context separation, keeping user input and system instructions in clearly distinct contexts. These mirror longstanding injection-vulnerability principles but are harder to enforce because instruction/data boundaries in agentic AI are often implicit and model-dependent. _Developers designing safer AI agents can keep up with security guidance like this on daily.dev._ ## Similar posts on daily.dev - [GitLost: GitHub's AI agent leaks private repos when asked](https://daily.dev/posts/gitlost-github-s-ai-agent-leaks-private-repos-when-asked-qlzfcubqe) · The Next Web · 2 upvotes · 1 comments - [GitHub AI agent leaks private repositories via prompt injection attack](https://daily.dev/posts/github-ai-agent-leaks-private-repositories-via-prompt-injection-attack-rd9immbqn) · CSO Online · 0 upvotes · 0 comments - [GitHub AI agent leaks private repositories via prompt injection attack](https://daily.dev/posts/github-ai-agent-leaks-private-repositories-via-prompt-injection-attack-ffq6gdzd6) · InfoWorld · 0 upvotes · 0 comments - [‘GitLost’ Flaw Lets Attackers Trick GitHub AI Agent Into Leaking Private Repos](https://daily.dev/posts/gitlost-flaw-lets-attackers-trick-github-ai-agent-into-leaking-private-repos-h2sgta49s) · DevOps.com · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#github](https://daily.dev/tags/github), [#ai-agents](https://daily.dev/tags/ai-agents), [#agentic-ai](https://daily.dev/tags/agentic-ai), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/gitlost-prompt-injection-attack-leaks-private-github-repo-data-through-ai-agents-1aozox5ma) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"GitLost: Prompt injection attack leaks private GitHub repo data through AI agents","url":"https://daily.dev/posts/gitlost-prompt-injection-attack-leaks-private-github-repo-data-through-ai-agents-1aozox5ma","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/gitlost-prompt-injection-attack-leaks-private-github-repo-data-through-ai-agents-1aozox5ma"},"datePublished":"2026-07-24T19:37:27.458Z","dateModified":"2026-09-13T19:40:13.935Z","description":"Security researchers at Noma Security discovered a prompt injection exploit called GitLost targeting GitHub's Agentic Workflows feature. By embedding hidden...","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/gitlost-prompt-injection-attack-leaks-private-github-repo-data-through-ai-agents-1aozox5ma","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,github,ai-agents,agentic-ai,prompt-injection","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"GitLost: Prompt injection attack leaks private GitHub repo data through AI agents"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/gitlost-prompt-injection-attack-leaks-private-github-repo-data-through-ai-agents-1aozox5ma#faq","mainEntity":[{"@type":"Question","name":"What is the GitLost prompt injection attack on GitHub AI agents?","acceptedAnswer":{"@type":"Answer","text":"GitLost is a prompt injection exploit found by Noma Security that lets an attacker with no credentials leak private GitHub repository data by embedding hidden instructions in a public GitHub issue. When an AI agent monitoring the repo processes the issue, it treats the injected text as a legitimate command and can be made to post private repo data into public comments. Teams deploying AI agents on code repos can track emerging prompt injection exploits like this via daily.dev."}},{"@type":"Question","name":"How did attackers bypass GitHub's prompt injection guardrails using the word Additionally?","acceptedAnswer":{"@type":"Answer","text":"Prepending injected instructions with the word \"Additionally\" caused the AI model to reclassify the malicious content as a continuation of its current task rather than a new instruction, slipping past GitHub's existing guardrails against prompt injection. This single-word trick was enough to defeat the protections Noma Security tested against. Anyone hardening agentic AI workflows against injection can follow findings like this on daily.dev."}},{"@type":"Question","name":"What mitigations do security researchers recommend for prompt injection in agentic AI systems?","acceptedAnswer":{"@type":"Answer","text":"Noma Security recommends three measures: least privilege, so agents only access what a task strictly requires; input isolation, so user-controlled content is never treated as trusted instruction; and context separation, keeping user input and system instructions in clearly distinct contexts. These mirror longstanding injection-vulnerability principles but are harder to enforce because instruction/data boundaries in agentic AI are often implicit and model-dependent. Developers designing safer AI agents can keep up with security guidance like this on daily.dev."}}]} ```