--- title: Indirect Prompt Injection Exploits GitHub's AI Agent to... description: Noma Security discovered GitLost, a prompt injection exploit targeting GitHub's Agentic Workflows. By embedding hidden instructions in public GitHub issues,... canonical: https://daily.dev/posts/indirect-prompt-injection-exploits-github-s-ai-agent-to-leak-private-repository-data-uim2qytqk twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Indirect Prompt Injection Exploits GitHub's AI Agent to Leak Private Repository Data | daily.dev og:description: Noma Security discovered GitLost, a prompt injection exploit targeting GitHub's Agentic Workflows. By embedding hidden instructions in public GitHub issues,... og:url: https://daily.dev/posts/indirect-prompt-injection-exploits-github-s-ai-agent-to-leak-private-repository-data-uim2qytqk og:image: https://api.daily.dev/og/posts/uiM2QyTqK.png og:image:alt: Indirect Prompt Injection Exploits GitHub's AI Agent to Leak Private Repository Data og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Indirect Prompt Injection Exploits GitHub's AI Agent to Leak Private Repository Data **[InfoQ](https://daily.dev/sources/infoq)** · 3 min read · 0 upvotes · 0 comments ## Summary Noma Security discovered GitLost, a prompt injection exploit targeting GitHub's Agentic Workflows. By embedding hidden instructions in public GitHub issues, attackers with no credentials or coding skills can trick AI agents into leaking private repository data via public comments. The exploit bypassed GitHub's guardrails using just the keyword 'Additionally', which caused the model to reclassify the injected content as a continuation of its current task rather than a new instruction. Researchers compare prompt injection to SQL injection as a systematic, category-wide vulnerability class for agentic AI. Mitigations include restricting agent permissions to least privilege, never treating user-controlled content as trusted instruction input, and isolating user input from the instruction context. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does the GitLost prompt injection exploit leak private GitHub repository data? An attacker opens a public GitHub issue containing hidden instructions; when a GitHub Agentic Workflow configured to trigger on issues.assigned reads the issue and responds via the add-comment tool, it can be manipulated into accessing restricted files from other repos (including private ones) it has read access to and posting their contents in a public comment. No coding skills, credentials, or repo access are needed. _Teams wiring AI agents into GitHub workflows can follow security disclosures like this one on daily.dev._ ### Why did the word Additionally bypass GitHub's AI agent guardrails in the GitLost exploit? The keyword 'Additionally' reframed the injected payload from an unrelated new instruction into what appeared to be a continuation of the agent's current task, causing the guardrail to misclassify malicious content as legitimate. The payload itself was unchanged; only the framing token shifted the model's interpretation, illustrating a decision-boundary flaw rather than a content-filtering flaw. _Following how small framing tricks defeat AI guardrails helps developers building agent-based tools on daily.dev._ ### What mitigations does Noma Security recommend against prompt injection in AI agents with repo access? Never treat user-controlled content, like issue titles or bodies, as trusted instruction input for an AI agent. Restrict agent permissions to only what is strictly necessary, since cross-repository access makes agents high-value targets. Limit what agents can publicly disclose when responding to issues, and sanitize or isolate user input from the model's instruction context. _Developers securing agentic AI integrations can track defense recommendations like these via daily.dev._ ## Similar posts on daily.dev - [GitLost: GitHub's AI agent leaks private repos when asked](https://daily.dev/posts/gitlost-github-s-ai-agent-leaks-private-repos-when-asked-qlzfcubqe) · The Next Web · 2 upvotes · 1 comments - [GitHub AI agent leaks private repositories via prompt injection attack](https://daily.dev/posts/github-ai-agent-leaks-private-repositories-via-prompt-injection-attack-rd9immbqn) · CSO Online · 1 upvotes · 0 comments - [‘GitLost’ Flaw Lets Attackers Trick GitHub AI Agent Into Leaking Private Repos](https://daily.dev/posts/gitlost-flaw-lets-attackers-trick-github-ai-agent-into-leaking-private-repos-h2sgta49s) · DevOps.com · 0 upvotes · 0 comments - ['GitLost' Flaw Leaks Private Data from GitHub's Agentic Workflows](https://daily.dev/posts/gitlost-flaw-leaks-private-data-from-github-s-agentic-workflows-jty8eoyaf) · Dark Reading · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#github](https://daily.dev/tags/github), [#ai-agents](https://daily.dev/tags/ai-agents), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/indirect-prompt-injection-exploits-github-s-ai-agent-to-leak-private-repository-data-uim2qytqk) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Indirect Prompt Injection Exploits GitHub's AI Agent to Leak Private Repository Data","url":"https://daily.dev/posts/indirect-prompt-injection-exploits-github-s-ai-agent-to-leak-private-repository-data-uim2qytqk","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/indirect-prompt-injection-exploits-github-s-ai-agent-to-leak-private-repository-data-uim2qytqk"},"datePublished":"2026-07-23T20:00:52.124Z","dateModified":"2026-09-13T20:55:01.669Z","description":"Noma Security discovered GitLost, a prompt injection exploit targeting GitHub's Agentic Workflows. By embedding hidden instructions in public GitHub issues,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/10d1891f1b94adc344194e4bb16cd6d5?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/10d1891f1b94adc344194e4bb16cd6d5?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"InfoQ","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"InfoQ","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/afc3bced3e1e4b188dd9127017a60e0c","url":"https://daily.dev/sources/infoq"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/indirect-prompt-injection-exploits-github-s-ai-agent-to-leak-private-repository-data-uim2qytqk","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,github,ai-agents,prompt-injection","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"InfoQ","item":"https://daily.dev/sources/infoq"},{"@type":"ListItem","position":3,"name":"Indirect Prompt Injection Exploits GitHub's AI Agent to Leak Private Repository Data"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/indirect-prompt-injection-exploits-github-s-ai-agent-to-leak-private-repository-data-uim2qytqk#faq","mainEntity":[{"@type":"Question","name":"How does the GitLost prompt injection exploit leak private GitHub repository data?","acceptedAnswer":{"@type":"Answer","text":"An attacker opens a public GitHub issue containing hidden instructions; when a GitHub Agentic Workflow configured to trigger on issues.assigned reads the issue and responds via the add-comment tool, it can be manipulated into accessing restricted files from other repos (including private ones) it has read access to and posting their contents in a public comment. No coding skills, credentials, or repo access are needed. Teams wiring AI agents into GitHub workflows can follow security disclosures like this one on daily.dev."}},{"@type":"Question","name":"Why did the word Additionally bypass GitHub's AI agent guardrails in the GitLost exploit?","acceptedAnswer":{"@type":"Answer","text":"The keyword 'Additionally' reframed the injected payload from an unrelated new instruction into what appeared to be a continuation of the agent's current task, causing the guardrail to misclassify malicious content as legitimate. The payload itself was unchanged; only the framing token shifted the model's interpretation, illustrating a decision-boundary flaw rather than a content-filtering flaw. Following how small framing tricks defeat AI guardrails helps developers building agent-based tools on daily.dev."}},{"@type":"Question","name":"What mitigations does Noma Security recommend against prompt injection in AI agents with repo access?","acceptedAnswer":{"@type":"Answer","text":"Never treat user-controlled content, like issue titles or bodies, as trusted instruction input for an AI agent. Restrict agent permissions to only what is strictly necessary, since cross-repository access makes agents high-value targets. Limit what agents can publicly disclose when responding to issues, and sanitize or isolate user input from the model's instruction context. Developers securing agentic AI integrations can track defense recommendations like these via daily.dev."}}]} ```